fix(sec): webhook SSRF-guard через Dialer.Control (закрытие DNS-rebinding TOCTOU)

2026-07-04 13:48:22 +07:00
parent 29f448d4b5
commit 070a32717f
3 changed files with 148 additions and 11 deletions
@@ -39,7 +39,10 @@ func NewDispatcher(store ChannelStore, cipher Decryptor) *Dispatcher {
 		cipher: cipher,
 		byType: map[string]Notifier{
 			"telegram": &Telegram{BaseURL: "https://api.telegram.org", HTTP: &http.Client{Timeout: 15 * time.Second}},
-			"webhook":  &Webhook{HTTP: &http.Client{Timeout: 15 * time.Second}},
+			"webhook": &Webhook{HTTP: &http.Client{
+				Timeout:   15 * time.Second,
+				Transport: newWebhookTransport(false),
+			}},
 		},
 	}
 }