Add an egress CIDR allowlist to the SSRF guard (closes #204) (#217)

internal/handlers/handlers.go

@@ -60,6 +60,7 @@ type HandlersParams struct {
 	Middleware   *middleware.Middleware
 	Notifier     delivery.Notifier
 	Evictor      delivery.WebhookEvictor
+	SSRFGuard    *delivery.Guard
 }
 
 // Handlers provides HTTP handler methods for all application
@@ -77,6 +78,11 @@ type Handlers struct {
 	mtr       *metrics.Set
 	templates map[string]*template.Template
 
+	// ssrf validates submitted target URLs. It is the same guard
+	// the delivery engine dials through, so a URL accepted here
+	// is one delivery will actually attempt.
+	ssrf *delivery.Guard
+
 	// dummyVerifications counts the equivalent-cost verifications
 	// charged for usernames that do not exist. It exists so a test
 	// can prove that path runs without measuring wall-clock time.
@@ -117,6 +123,7 @@ func New(
 	s.notifier = params.Notifier
 	s.evictor = params.Evictor
 	s.mtr = metrics.Default()
+	s.ssrf = params.SSRFGuard
 
 	// Parse all page templates once at startup
 	s.templates = map[string]*template.Template{

internal/handlers/handlers_test.go

@@ -110,6 +110,7 @@ func newTestApp(
 				return r
 			},
 			middleware.New,
+			delivery.NewGuard,
 			handlers.New,
 		),
 		fx.Populate(targets...),

internal/handlers/source_management.go

@@ -1607,7 +1607,7 @@ func (h *Handlers) validateTargetURL(
 		return errMissingURL
 	}
 
-	err := delivery.ValidateTargetURL(
+	err := h.ssrf.ValidateTargetURL(
 		r.Context(), targetURL,
 	)
 	if err != nil {