121 lines
3.2 KiB
Go
121 lines
3.2 KiB
Go
package notify
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"net"
|
|
"net/http"
|
|
"net/url"
|
|
)
|
|
|
|
// Webhook delivers notifications as a JSON POST of the Event to a
|
|
// project-configured URL. Config is {"url": "..."}. secret is currently
|
|
// unused (reserved for future request signing) and is never logged.
|
|
//
|
|
// The destination URL is project-controlled (any project owner can set it),
|
|
// so it is treated as untrusted input: isAllowedURL blocks requests to
|
|
// loopback/private/link-local/unspecified addresses to prevent SSRF against
|
|
// internal services and cloud metadata endpoints (e.g. 169.254.169.254).
|
|
// Redirects are not followed, since a redirect response could otherwise be
|
|
// used to bypass the destination check.
|
|
type Webhook struct {
|
|
HTTP *http.Client
|
|
|
|
// allowPrivate disables the SSRF guard. It exists only so tests can
|
|
// exercise Send happy-paths against httptest servers, which listen on
|
|
// loopback. Production Dispatchers (NewDispatcher) must never set this.
|
|
allowPrivate bool
|
|
}
|
|
|
|
// isAllowedURL rejects any URL that is not a plain http/https request to a
|
|
// public, resolvable address. It resolves hostnames and checks every
|
|
// returned address — a hostname that resolves to even one
|
|
// private/loopback/link-local/unspecified address is rejected, since DNS
|
|
// answers are attacker-influenceable (rebinding) and partial trust is not
|
|
// safe.
|
|
func isAllowedURL(rawurl string) error {
|
|
u, err := url.Parse(rawurl)
|
|
if err != nil {
|
|
return fmt.Errorf("webhook: invalid url: %w", err)
|
|
}
|
|
if u.Scheme != "http" && u.Scheme != "https" {
|
|
return errors.New("webhook: destination not allowed")
|
|
}
|
|
host := u.Hostname()
|
|
if host == "" {
|
|
return errors.New("webhook: destination not allowed")
|
|
}
|
|
|
|
var ips []net.IP
|
|
if ip := net.ParseIP(host); ip != nil {
|
|
ips = []net.IP{ip}
|
|
} else {
|
|
resolved, err := net.LookupIP(host)
|
|
if err != nil {
|
|
return errors.New("webhook: destination not allowed")
|
|
}
|
|
ips = resolved
|
|
}
|
|
|
|
for _, ip := range ips {
|
|
if isDisallowedIP(ip) {
|
|
return errors.New("webhook: destination not allowed")
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func isDisallowedIP(ip net.IP) bool {
|
|
return ip.IsLoopback() ||
|
|
ip.IsPrivate() ||
|
|
ip.IsLinkLocalUnicast() ||
|
|
ip.IsLinkLocalMulticast() ||
|
|
ip.IsUnspecified() ||
|
|
ip.IsMulticast()
|
|
}
|
|
|
|
func (w *Webhook) Send(ctx context.Context, cfg json.RawMessage, secret string, ev Event) error {
|
|
var c struct {
|
|
URL string `json:"url"`
|
|
}
|
|
if err := json.Unmarshal(cfg, &c); err != nil {
|
|
return err
|
|
}
|
|
if !w.allowPrivate {
|
|
if err := isAllowedURL(c.URL); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
body, err := json.Marshal(ev)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.URL, bytes.NewReader(body))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
|
|
client := w.HTTP
|
|
if client.CheckRedirect == nil {
|
|
clientCopy := *client
|
|
clientCopy.CheckRedirect = func(req *http.Request, via []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
}
|
|
client = &clientCopy
|
|
}
|
|
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
|
|
return fmt.Errorf("webhook: status %d", resp.StatusCode)
|
|
}
|
|
return nil
|
|
}
|