Block webhook SSRF via hostnames that resolve to internal IPs - #230
Conversation
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
|
Warning Review limit reached
Next review available in: 17 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChangesWebhook SSRF validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant deliver
participant validate_webhook_url
participant log_delivery
participant HTTPClient
deliver->>validate_webhook_url: validate stored webhook.url
validate_webhook_url-->>deliver: validation result
deliver->>log_delivery: record blocked_ssrf when rejected
deliver->>HTTPClient: send request when allowed
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/agentflare-backend/src/webhook.rs`:
- Around line 166-167: Update the host validation logic around the IPv4 and IPv6
branches to normalize IPv4-mapped IPv6 addresses with to_ipv4_mapped() and run
them through the existing IPv4 blocking checks before applying IPv6 checks.
Ensure mapped localhost literals such as ::ffff:127.0.0.1 are rejected, and add
a regression test covering that URL.
- Around line 147-151: Update validate_webhook_url and deliver so DNS resolution
and blocked-IP validation are tied to the same outbound connection, preventing
hostname rebinding between preflight and connect; connect using the validated
resolved address or otherwise revalidate the address immediately before sending.
Extend is_blocked_ip to normalize IPv4-mapped IPv6 addresses and apply the IPv4
blocked-range checks to the mapped address.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 64ee0b2b-18ea-4f98-bef8-631093319b85
📒 Files selected for processing (1)
crates/agentflare-backend/src/webhook.rs
| Some(url::Host::Ipv4(v4)) => is_blocked_ip(std::net::IpAddr::V4(v4)), | ||
| Some(url::Host::Ipv6(v6)) => is_blocked_ip(std::net::IpAddr::V6(v6)), |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant file section with line numbers.
sed -n '130,230p' crates/agentflare-backend/src/webhook.rs
# Look for related IP checks and tests.
rg -n "to_ipv4_mapped|is_blocked_ip|loopback|localhost|private|unique_local|link_local|multicast" crates/agentflare-backend/src -SRepository: getappz/agentflare
Length of output: 6157
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Read the IP predicate and nearby tests.
sed -n '110,210p' crates/agentflare-backend/src/webhook.rs
printf '\n--- TESTS ---\n'
sed -n '420,510p' crates/agentflare-backend/src/webhook.rsRepository: getappz/agentflare
Length of output: 7270
Reject IPv4-mapped IPv6 literals.
http://[::ffff:127.0.0.1]/ bypasses the IPv6 branch because is_loopback() only catches ::1. Normalize mapped addresses with to_ipv4_mapped() and apply the IPv4 checks first; add a regression test for a mapped localhost URL.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@crates/agentflare-backend/src/webhook.rs` around lines 166 - 167, Update the
host validation logic around the IPv4 and IPv6 branches to normalize IPv4-mapped
IPv6 addresses with to_ipv4_mapped() and run them through the existing IPv4
blocking checks before applying IPv6 checks. Ensure mapped localhost literals
such as ::ffff:127.0.0.1 are rejected, and add a regression test covering that
URL.
0752b3a to
b9abaff
Compare
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
b9abaff to
530e862
Compare
1 participant
Summary
validate_webhook_url(crates/agentflare-backend/src/webhook.rs) blocked SSRF only when the webhook host was an IP literal in a private/link-local/loopback range. A domain host was let through after only a literal== "localhost"check, so a hostname that resolves to an internal address bypassed the guard entirely:An agent registering webhooks over MCP could thus point delivery at cloud metadata endpoints or other loopback/RFC1918 services and receive the response body back (it is logged to
webhook_logs).This PR resolves domain hosts and applies the same
is_blocked_ipcheck to every resolved address:domain_resolves_to_blocked_ipusesToSocketAddrsand rejects if any resolved IP is blocked. A resolution failure is treated as "not provably internal" and allowed through, so a transient DNS error can't take down legitimate hooks (a genuinely unresolvable host fails at send anyway).deliver()now re-validates the stored URL on every send, not just at creation — this narrows the DNS-rebinding window where a host validated as external atcreatetime is later repointed at an internal IP. A blocked send is recorded as ablocked_ssrfdelivery-log row instead of hitting the network.This complements the existing hardening already in this file (redirects disabled, response body capped, HMAC-signed payloads).
Test plan
cargo test -p agentflare-backend(69 passed)cargo clippy -p agentflare-backend --all-targets --all-features -- -D warnings -A unsafe_code -A clippy::pedanticcargo fmt --checkNew test
domain_resolution_flags_names_pointing_at_loopbackpins the resolution path usinglocalhost(deterministic offline via/etc/hosts).Notes for reviewers
validate_webhook_urlnow performs DNS resolution, socreate/update/delivercan incur a lookup. Resolution errors intentionally do not block (availability over strictness); the check only fires on a successful resolution to an internal IP. Residual TOCTOU between resolve and connect remains (ureq connects by hostname) but the per-send re-validation shrinks it substantially.blocked_ssrfvalue can appear inwebhook_logs.response_status.Link to Devin session: https://app.devin.ai/sessions/f86e3441ccb34626ad93fb5023a26134
Requested by: @getappz
Summary by CodeRabbit