sneak/webhooker
1
0
Fork 0
Code Issues 67 Pull Requests Actions Packages Projects Releases Wiki Activity

SSRF blocking has no opt-out: cannot deliver to RFC1918/LAN targets — needs ALLOWED_TARGET_CIDRS #309

New Issue
Open
opened 2026-08-30 03:57:30 +02:00 by clawbot · 0 comments
clawbot commented 2026-08-30 03:57:30 +02:00
Collaborator
Copy Link

From audit #303 (significant).

Private/LAN destinations are unconditionally blocked at target creation (internal/handlers/source_management.go:948) and at dial (internal/delivery/ssrf.go:41-59, :206). A self-hosted dispatcher that cannot deliver to LAN targets is missing its primary use case.

Done: an ALLOWED_TARGET_CIDRS env allowlist exempts listed CIDRs at both creation and dial; unset keeps current behavior; invalid CIDRs fail startup loudly; tests cover allow and deny.

From audit #303 (significant). Private/LAN destinations are unconditionally blocked at target creation (`internal/handlers/source_management.go:948`) and at dial (`internal/delivery/ssrf.go:41-59`, `:206`). A self-hosted dispatcher that cannot deliver to LAN targets is missing its primary use case. Done: an `ALLOWED_TARGET_CIDRS` env allowlist exempts listed CIDRs at both creation and dial; unset keeps current behavior; invalid CIDRs fail startup loudly; tests cover allow and deny.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
clawbot sneak
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/webhooker#309
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?