fix(security): prevent outbound webhook SSRF - #552

Draft

seonghobae wants to merge 160 commits into

fix/webhook-ssrf-551

Commits on Aug 18, 2026

test(security): reject unsafe outbound webhook destinations
seonghobae
committed
1270be5
test(security): register webhook destination regression
seonghobae
committed
006cfab
fix(security): pin outbound webhook destinations
seonghobae
committed
9ca1417
test(security): cover special-use webhook destinations
seonghobae
committed
835a220
docs(security): record webhook SSRF transport evidence
seonghobae
committed
a40bc5e
test(security): preserve facade integration evidence
seonghobae
committed
6c53673
docs(changelog): record outbound webhook SSRF hardening
seonghobae
committed
9728722
test(security): cover reserved webhook address space
seonghobae
committed
aa0a18b
fix(security): restrict webhooks to public unicast space
seonghobae
committed
d4f4074
test(security): preserve webhook authorization ordering
seonghobae
committed
81093fb
fix(security): preserve webhook authorization before policy
seonghobae
committed
f1a7159
test(security): require canonical webhook persistence
seonghobae
committed
e7e18c6
fix(security): persist canonical webhook destinations
seonghobae
committed
be1fff9
test(a11y): verify facade static asset behavior
seonghobae
committed
ee3fe39
test(a11y): configure facade fixture authentication
seonghobae
committed
287a07b
test(security): specify current review regressions
seonghobae
committed
2ceaa26
test(security): execute review regressions
seonghobae
committed
614b84e
test(security): refine review regression boundary
seonghobae
committed
6d35afb
fix(api): harden request and identity boundaries
seonghobae
committed
8de2331
refactor(api): remove dead header helper
seonghobae
committed
5f56325
test(webhook): require fallback across public DNS candidates
seonghobae
committed
bdec0c9
fix(webhook): fall back across validated addresses
seonghobae
committed
d5b9fce
test(webhook): bound candidate fallback behavior
seonghobae
committed
f25874c
test(auth): require bounded OIDC token exchange
seonghobae
committed
bea73f8
test(auth): execute OIDC timeout regression
seonghobae
committed
33aff6a
fix(auth): bound OIDC token exchange
seonghobae
committed
e856a6d
test(security): reproduce inherited static-map lookup
seonghobae
committed
2b1ddf9
test(security): execute static prototype-pollution regression
seonghobae
committed
a634de8
fix(security): make static allowlist prototype-free
seonghobae
committed
afaffbd
fix(regression): preserve logout-all token email
seonghobae
committed
ec54783
test(fetch): reproduce consumed Request fallback
seonghobae
committed
5396c7a
fix(fetch): forward the effective Request
seonghobae
committed
9620ade
test(oidc): require signed issuer-bound nonce tokens
seonghobae
committed
9d6cd27
fix(oidc): bind and verify ID token claims
seonghobae
committed
235883e
test(oidc): reject provider redirects
seonghobae
committed
e7d8d4d
fix(oidc): reject provider redirects
seonghobae
committed
e886054
test(oidc): preserve callback cancellation
seonghobae
committed
9637205
fix(oidc): preserve callback cancellation
seonghobae
committed
78c3924
test(security): model enumerable prototype pollution
seonghobae
committed
621eaf6
test(webhook): assert fallback socket pinning
seonghobae
committed
f510f33
test(security): isolate static prototype lookup regression
seonghobae
committed
9de1b8a
test(security): require stable webhook validation code
seonghobae
committed
fb6ffe9
fix(security): expose stable webhook validation code
seonghobae
committed
06d684d
revert: restore exact webhook core before focused repair
seonghobae
committed
b3e904c
test(security): decouple webhook auth probe from copy
seonghobae
committed
d8841e2
fix(security): decouple webhook authorization probe from copy
seonghobae
committed
a796553
test(security): require stable webhook validation code
seonghobae
committed
49f68a9
test(security): reject arbitrary authorization-probe 400
seonghobae
committed
fe103bf
fix(security): make webhook auth probe explicit
seonghobae
committed
9601679
test(security): authenticate before webhook body parsing
seonghobae
committed
79c7463
test(security): bound invalid-token webhook buffering
seonghobae
committed
41d979b
fix(security): bound pre-auth webhook body reads
seonghobae
committed
ebcd3f6
fix(security): preserve unauthenticated request streams
seonghobae
committed
612c0b9
test(oidc): require discovered provider endpoints
seonghobae
committed
88891ed
fix(oidc): honor discovered provider endpoints
seonghobae
committed
366d732
test(oidc): reproduce metadata-driven private endpoint SSRF
seonghobae
committed
bd97e40
feat(security): expose DNS-pinned public HTTPS transport
seonghobae
committed
451267a
fix(oidc): pin metadata-driven HTTPS requests to public DNS
seonghobae
committed
17eb13e
test(security): cover reusable public HTTPS transport
seonghobae
committed
b687055
test(auth): reproduce production mock OIDC exposure
seonghobae
committed
09799da
test(security): bound OIDC state capacity
seonghobae
committed
17419b2
fix(security): cap pending OIDC state entries
seonghobae
committed
3b7fc68
test(security): expose core OIDC state growth
seonghobae
committed
9ccfb75
test(security): execute core OIDC capacity regression
seonghobae
committed
5281e04
fix(auth): bound core OIDC state capacity
seonghobae
committed
1f4ee85
test(auth): reject production OIDC mock fallback
seonghobae
committed
afad9f2
test(auth): execute OIDC mock production regression
seonghobae
committed
4ef7d2e
test(auth): exercise public OIDC facade
seonghobae
committed
b123497
fix(auth): disable mock OIDC outside development
seonghobae
committed
a61e107
test(oidc): require bounded JWKS cache reuse
seonghobae
committed
f637f5e
fix(oidc): cache validated signing key evidence
seonghobae
committed
5bfb2be
test(oidc): reject state at exact expiry boundary
seonghobae
committed
9fbdbae
test(oidc): prevent metadata replay after response
seonghobae
committed
15cca54
test(ci): register OIDC production and transport regressions
seonghobae
committed
2ffc599
test(oidc): preserve fail-closed 404 contract
seonghobae
committed
21295f5
fix(oidc): prevent response replay and compression
seonghobae
committed
8e1221a
test(oidc): cover inclusive state expiry boundary
seonghobae
committed
4d71b5c
fix(oidc): expire state inclusively at TTL boundary
seonghobae
committed
5b0c3af

Commits on Aug 19, 2026

Commits on Aug 20, 2026

fix(stack): reconcile SSRF boundary with protected dependency bump
seonghobae
committed
96ffbac
fix(stack): reconcile SSRF boundary with current develop
seonghobae
committed
795b516
fix(stack): preserve protected Playwright version
seonghobae
committed
e8531e1
fix(stack): preserve protected Playwright lockfile
seonghobae
committed
7fb7d7a
test(transport): reproduce null-body response deadlock
seonghobae
committed
6437202
fix(transport): settle null-body responses safely
seonghobae
committed
60bed47
test(auth): preserve legacy email identity compatibility
seonghobae
committed
adf83bd
fix(auth): retain legacy email account reachability
seonghobae
committed
71ab96b
test(security): reject OIDC flow at exact expiry
seonghobae
committed
ccae5fe
fix(security): expire OIDC bindings inclusively
seonghobae
committed
d6c61b8
test(security): isolate facade OIDC expiry boundary
seonghobae
committed
a0a3220

Commits on Aug 22, 2026

test(oidc): reject future not-before ID tokens
seonghobae
committed
ba61032
fix(oidc): enforce ID token not-before
seonghobae
committed
b726df8
test(observability): cover facade rejection accounting
seonghobae
committed
01833c5
fix(observability): run webhook policy guard on real POST
seonghobae
committed
760ba5c
test(observability): cover facade OIDC rejection
seonghobae
committed
c668ada
fix: preserve probe errors and facade observability
seonghobae
committed
83b7d69
test(metrics): reproduce missing facade Prometheus counts
seonghobae
committed
d9da6f3
fix(metrics): merge facade counts into Prometheus
seonghobae
committed
5d561ef
test(oidc): reproduce multi-key JWKS cache thrash
seonghobae
committed
ac6af17
fix(oidc): bound signing-key cache per kid
seonghobae
committed
f91efeb
test(auth): reproduce unbounded public-body buffering
seonghobae
committed
30dc201
fix(auth): bound public authentication bodies
seonghobae
committed
d11340b
test(webhooks): reproduce legacy HTTP migration gap
seonghobae
committed
e0de2b4
test(webhooks): register legacy HTTP migration regression
seonghobae
committed
fb99534
fix(webhooks): fail closed legacy HTTP subscriptions
seonghobae
committed
c1e72a2
test(webhooks): normalize sqlite migration rows
seonghobae
committed
94b51d2
test(security): reject caller webhook content-length framing
seonghobae
committed
49ddec8
fix(security): own webhook content-length framing
seonghobae
committed
80f6355
test(security): reject stale public transport content-length
seonghobae
committed
3da8155
fix(security): own public transport content length
seonghobae
committed
1dd7815
test(security): reject unverified OIDC email identities
seonghobae
committed
f92fdc6
test(security): run OIDC email verification regression
seonghobae
committed
bc5678a
fix(security): require verified OIDC email claims
seonghobae
committed
e62f5c3
test(oidc): mark valid email fixtures verified
seonghobae
committed
d153ec9
test(auth): require stable OIDC subject identity
seonghobae
committed
5bde3f3
feat(auth): persist stable OIDC identities
seonghobae
committed
96b7af6
fix(auth): bind OIDC sessions to issuer subject
seonghobae
committed
de3d041
test(auth): include OIDC identity coverage
seonghobae
committed
37f6625
test(auth): order OIDC takeover before email change
seonghobae
committed
6f5beb3
test(auth): reject implicit OIDC password-account linking
seonghobae
committed
f1d2731
fix(auth): refuse implicit OIDC account adoption
seonghobae
committed
5dc1561
test(oidc): normalize sqlite rows for strict identity assertion
seonghobae
committed
a5eb7a3
test(oidc): require atomic first-login identity binding
seonghobae
committed
0850c24
fix(oidc): bind first login atomically
seonghobae
committed
8c6c12b
test(oidc): preserve signup accounting across atomic bind
seonghobae
committed
dc1b61d
test(oidc): assert fail-closed atomic bind response
seonghobae
committed
9a10ba3
fix(metrics): count first-time OIDC signups
seonghobae
committed
2b1ec44
test(fuzz): reproduce truncated iteration budgets
seonghobae
committed
2b80d83
fix(fuzz): honor bounded iteration budgets
seonghobae
committed
2ad7da7
test(oidc): reproduce whitespace shadow-account split
seonghobae
committed
bf9e2f0
test(oidc): require canonical verified email claims
seonghobae
committed
1b76803
fix(oidc): reject non-canonical verified email claims
seonghobae
committed
ba2aab4

Commits on Aug 23, 2026

Commits on Aug 25, 2026

test: reject process-wide console observability mutation
seonghobae
committed
5aa0cb2
test: register console observability regression
seonghobae
committed
3b8b9c0
fix: stop mutating process-wide console logging
seonghobae
committed
fdb2ab5

Commits on Aug 26, 2026

Commits on Aug 27, 2026

test: cover legacy private HTTPS webhook migration
seonghobae
committed
f53a979
test: run legacy private webhook migration regression
seonghobae
committed
9ac687d
fix: quarantine legacy webhook destinations by policy
seonghobae
committed
3af41ed
fix(security): quarantine legacy private webhooks
seonghobae
committed
ef8af83
test(webhooks): reproduce no-op private migration lock
seonghobae
committed
6228733
fix(webhooks): avoid no-op migration writer lock
seonghobae
committed
9659689
fix(db): consolidate webhook startup reconciliation
seonghobae
committed
92487d1