GHSA-r2x7-427f-rq69

## Summary The `validateWebhookURL` function in `webhook_setting_service.go` attempts to block webhooks targeting private/internal IP addresses, but only checks literal IP strings via `net.ParseIP()`. Hostnames that DNS-resolve to private IPs (e.g., `169.254.169.254.nip.io`, `10.0.0.1.nip.io`) bypass all checks, allowing an admin to create webhooks that make server-side requests to internal network services and cloud metadata endpoints. ## Details The vulnerability is in `validateWebhookURL` (`internal/service/setting/webhook_setting_service.go:180-199`): ```go func validateWebhookURL(rawURL string) error { parsed, err := url.Parse(rawURL) // ... host := strings.ToLower(parsed.Hostname()) if host == "" || host == "localhost" || strings.HasSuffix(host, ".local") { return errors.New(commonModel.INVALID_WEBHOOK_URL) } if ip := net.ParseIP(host); ip != nil { // <-- returns nil for hostnames if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalMulticast() || ip.IsLinkLocalUnicast() || ip.IsUnspecified() { return errors.New(commonModel.INVALID_WEBHOOK_URL) } } return nil // hostname passes all checks unchecked } ``` `net.ParseIP("169.254.169.254.nip.io")` returns `nil` because it is not a literal IP address. The entire private IP check block is skipped, and the function returns `nil` (valid). Both HTTP clients that execute webhook requests use standard `http.Client` / `http.Transport` with no custom `DialContext` to verify resolved IPs: - **TestWebhook** (`webhook_setting_service.go:169`): `&http.Client{Timeout: 5 * time.Second}` - **Dispatcher** (`dispatcher.go:51-58`): `&http.Client{...Transport: &http.Transport{...}}` — no custom dialer The `Dispatcher.HandleObservation` (`dispatcher.go:67-81`) iterates all active webhooks and dispatches without re-validating URLs, so a stored malicious webhook triggers SSRF on every application event. **Execution flow:** 1. Admin calls POST `/a