security(scanner): detect stored SSRF webhook persistence

.jules/sentinel.md

@@ -122,3 +122,8 @@
 **Vulnerability:** DOM XSS via unescaped `severity` string interpolated into `innerHTML` in `scanner/dashboard/index.html`.
 **Learning:** Even enum-like or seemingly safe meta-fields like `severity` can contain malicious payloads if sourced from user input (findings file) and directly injected into innerHTML.
 **Prevention:** Always use the `esc()` sanitizer for any dynamically rendered property from `findings.json`, regardless of expected schema types.
+
+## 2024-05-24 - [SSRF in Webhook Endpoint]
+**Vulnerability:** The `/api/v1/webhook` endpoint accepted arbitrary URLs for the drift alert webhook without any server-side request forgery (SSRF) validation before saving them to the database.
+**Learning:** Even if a URL is validated prior to use (e.g., in `_send_alert`), accepting and storing arbitrary URLs without validation introduces a Stored SSRF vulnerability vector and violates the principle of failing fast and securely on untrusted input.
+**Prevention:** Always apply security validation functions (like `_is_safe_url`) immediately at the boundary/endpoint level prior to performing database insertion or mutation.

appguardrail_core/controlplane.py

@@ -631,8 +631,11 @@ def do_POST(self):
                 body = self._body()
                 if body is None:
                     return self._json(400, {"error": "invalid JSON body"})
-                set_webhook(conn, org, (body or {}).get("url"))
-                return self._json(200, {"webhook_url": (body or {}).get("url")})
+                webhook_url = (body or {}).get("url")
+                if webhook_url and not _is_safe_url(webhook_url):
+                    return self._json(400, {"error": "unsafe webhook url"})
+                set_webhook(conn, org, webhook_url)
+                return self._json(200, {"webhook_url": webhook_url})
 
             if path == "/api/v1/keys":
                 if not has_role(role, "owner"):

tests/test_controlplane.py

@@ -231,6 +231,15 @@ def test_api_set_webhook(server):
     assert status == 200 and body["webhook_url"] == "http://hook.example/y"
 
 
+def test_api_set_webhook_unsafe_url(server):
+    base, key = server
+    with pytest.raises(urllib.error.HTTPError) as e:
+        _req("POST", f"{base}/api/v1/webhook", key, {"url": "http://127.0.0.1/"})
+    assert e.value.code == 400
+    body = json.loads(e.value.read())
+    assert body["error"] == "unsafe webhook url"
+
+
 def test_roles_and_key_scoping():
     conn = connect(":memory:")
     oid, owner_key = create_org(conn, "Acme")