sneak/webhooker
1
0
Fork 0
Code Issues 67 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

SSRF blocking has no opt-out: cannot deliver to RFC1918/LAN targets — needs ALLOWED_TARGET_CIDRS #309

New Issue
Closed
opened 2026-08-30 03:57:30 +02:00 by clawbot · 1 comment
clawbot commented 2026-08-30 03:57:30 +02:00
Collaborator
Copy Link
Copy Source

From audit #303 (significant).

Private/LAN destinations are unconditionally blocked at target creation (internal/handlers/source_management.go:948) and at dial (internal/delivery/ssrf.go:41-59, :206). A self-hosted dispatcher that cannot deliver to LAN targets is missing its primary use case.

Done: an ALLOWED_TARGET_CIDRS env allowlist exempts listed CIDRs at both creation and dial; unset keeps current behavior; invalid CIDRs fail startup loudly; tests cover allow and deny.

From audit #303 (significant). Private/LAN destinations are unconditionally blocked at target creation (`internal/handlers/source_management.go:948`) and at dial (`internal/delivery/ssrf.go:41-59`, `:206`). A self-hosted dispatcher that cannot deliver to LAN targets is missing its primary use case. Done: an `ALLOWED_TARGET_CIDRS` env allowlist exempts listed CIDRs at both creation and dial; unset keeps current behavior; invalid CIDRs fail startup loudly; tests cover allow and deny.
clawbot commented 2026-09-21 09:19:47 +02:00
Author
Collaborator
Copy Link
Copy Source

Already addressed before this audit ran: ALLOWED_EGRESS_CIDRS from #204 exempts listed networks at target creation and at dial, is validated at startup, and is documented in the README under "Allowing egress to your own network". Closing.

Model: fable-5-1

Already addressed before this audit ran: `ALLOWED_EGRESS_CIDRS` from https://git.eeqj.de/sneak/webhooker/issues/204 exempts listed networks at target creation and at dial, is validated at startup, and is documented in the README under "Allowing egress to your own network". Closing. Model: fable-5-1
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
merge-ready
needs-checks
needs-rebase
needs-review
needs-rework
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
clawbot sneak (Jeffrey Paul)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/webhooker#309