Merge branch 'v2' into develop

# Conflicts: # CHANGELOG.md
craftcms · Sep 18, 2023 · 65da4c8 · 65da4c8
2 parents bab74a8 + 02c039e
commit 65da4c8
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Release Notes for Webhooks for Craft CMS
 
+## Unreleased
+
+### Fixed
+
+- Fixed a potential SSRF vulnerability.
+
 ## 3.0.4 - 2022-06-01
 
 ### Fixed

diff --git a/src/Webhook.php b/src/Webhook.php
@@ -125,6 +125,15 @@ protected function defineRules(): array
             [['groupId'], 'number'],
             [['enabled'], 'boolean'],
             [['method'], 'in', 'range' => ['get', 'post', 'put']],
+            [
+                ['url'],
+                function(string $attribute, array $params = null, Validator $validator) {
+                    // Don't allow connecting to well-known cloud instance metadata endpoints
+                    if (str_contains($this->url, '169.254.169.254') || str_contains($this->url, 'metadata.google.internal')) {
+                        $validator->addError($this, $attribute, Craft::t('webhooks', 'Invalid URL.'));
+                    }
+                },
+            ],
             [
                 ['class'],
                 function(string $attribute, array $params = null, Validator $validator) {