Skip to content

fix(webhooks): block root-dotted internal hosts#52

Open
aiirvizionz wants to merge 1 commit into
moshcoder:masterfrom
aiirvizionz:clientkit/block-trailing-dot-localhost
Open

fix(webhooks): block root-dotted internal hosts#52
aiirvizionz wants to merge 1 commit into
moshcoder:masterfrom
aiirvizionz:clientkit/block-trailing-dot-localhost

Conversation

@aiirvizionz

Copy link
Copy Markdown
Contributor

Summary

  • normalize trailing DNS root dots before SSRF hostname checks
  • block localhost., *.localhost., and metadata.google.internal. webhook targets
  • add focused regression coverage for root-dotted internal hostnames

Tests

  • node --test tests*.mjs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant