Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Webhook URL sanity check is too restrictive #6570

Closed
FreakyPenguin opened this issue Aug 7, 2024 · 3 comments · Fixed by #6575
Closed

Webhook URL sanity check is too restrictive #6570

FreakyPenguin opened this issue Aug 7, 2024 · 3 comments · Fixed by #6575
Assignees
Labels
good first issue Good for newcomers

Comments

@FreakyPenguin
Copy link

Hi everyone,

We just ran into this with our on-prem deployment for testing. The sanity check regex for an URL seems way too restrictive:

/^(https?:\/\/)?(www.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-z]{2,63}\b([-a-zA-Z0-9@:%_+.~#?&//=]*)/i,

This precludes ip addresses, or hostnames without a tld and a number of other useful urls. I would suggest using something more generic here or adding a config option to override.

Thanks

@FelixMalfait
Copy link
Member

Good point! Since it's on the frontend, if you're blocked by this you can probably do an API call directly (copy the curl in your Chrome network inspector for example and change the url to the one that wasn't accepted)

@AnanteshG
Copy link
Contributor

Hi, I’d like to work on this issue.

AnanteshG added a commit to AnanteshG/twenty that referenced this issue Aug 7, 2024
Changes
- Replaced the old regex with a new, more inclusive regex pattern.
- Updated the isURL function to use the new pattern.
@Weiko
Copy link
Member

Weiko commented Aug 8, 2024

imho, there is no way to know 'google' is an url if we make the protocol (already the case) and the tld optionals. If we want to remove restrictions I wouldn't update the isUrl method (that could have impact in the rest of the app) but would remove the call to isUrl in the webhook section.

@Weiko Weiko closed this as completed in 13d05d8 Aug 9, 2024
@github-project-automation github-project-automation bot moved this from 🆕 New to ✅ Done in Product development ✅ Aug 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers
Projects
Archived in project
Development

Successfully merging a pull request may close this issue.

4 participants