fix: validate webhook URL scheme to prevent SSRF via urllib

2026-08-25 07:42:47 +00:00
parent 559ca6ddb7
commit 003091d96b
1 changed files with 5 additions and 0 deletions
@@ -280,6 +280,11 @@ class OrdersHandler(BaseHTTPRequestHandler):
            try:
                import urllib.request
                import json
+                import urllib.parse
+                parsed = urllib.parse.urlparse(webhook_url)
+                if parsed.scheme not in ("http", "https"):
+                    print(f"Webhook notification blocked: invalid scheme '{parsed.scheme}'")
+                    return
                data = json.dumps({"email": email, "note_id": note_id}).encode()
                req = urllib.request.Request(webhook_url, data=data, headers={"Content-Type": "application/json"})
                urllib.request.urlopen(req, timeout=10)