Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
## Summary The conditions filter webhook at `libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts` line 261 sends POST requests to user-configured URLs using raw `axios.post()` with no SSRF validation. The HTTP Request workflow step in the same codebase correctly uses `validateUrlSsrf()` which blocks private IP ranges. The conditions webhook was not included in this protection. ## Root Cause `conditions-filter.usecase.ts` line 261: ```typescript return await axios.post(child.webhookUrl, payload, config).then((response) => { return response.data as Record<string, unknown>; }); ``` No call to `validateUrlSs
- Auf 3.15.0 aktualisieren
Veröffentlicht Aktualisiert