[Ranjeet2063]

Closes #823

Summary of Changes

This pull request implements comprehensive SSRF hardening and DNS rebinding protections for outbound webhooks according to the specifications in #823:

1. Protocol Hardening:

   • Enforces scheme in production environments ().
   • Restricts endpoints in development strictly to and / .

2. IP Range and Hostname Resolution Blocking:

   • At both registration time () and delivery time (), validates the endpoint address to prevent SSRF and defeat DNS rebinding attacks.
   • Utilizes to parse IPv4 and IPv6 addresses, classifying and blocking:
     • Loopback addresses (, )
     • Link-local addresses ( cloud metadata, )
     • Private RFC 1918 subnets (, , )
     • IPv6 unique local addresses ()
     • Unspecified / broadcast addresses ()
     • IPv4-mapped IPv6 addresses ()

3. Safe Outbound Dispatch:

   • Disables following HTTP redirects blindly on webhook delivery () to prevent open-redirect SSRF bypasses.
   • Capped response body consumption to prevent memory exhaustion from oversized subscriber payloads.

4. Automated Unit Tests ():

   • Tests covering loopback, AWS metadata (), private IPv4 classes (A, B, C), and IPv6 (link-local and unique local).
   • Test verifying that hostnames resolving to private IPs are rejected during registration and delivery.
   • Test confirming is passed to outbound fetch calls.

Verification Proof

• : 22 passed across the entire suite.

/data/workspaces/audioblock-backend/src/tests/WebhookService.test.ts
17:17 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
106:62 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
107:61 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
110:22 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
125:65 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
127:22 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
139:64 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
141:22 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
152:13 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
185:51 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
197:51 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
321:64 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any

/data/workspaces/audioblock-backend/src/services/WebhookService.ts
16:18 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
122:32 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
145:39 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
217:19 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
229:41 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
234:28 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
326:35 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
328:27 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
543:57 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
554:40 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
561:11 warning 'allActive' is assigned a value but never used. Allowed unused vars must match /^_/u unused-imports/no-unused-vars
600:71 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any
605:51 warning Unexpected any. Specify a different type @typescript-eslint/no-explicit-any

✖ 25 problems (0 errors, 25 warnings): Passed with 0 errors.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.