Skip to content

Corrige validação de URL para permitir localhost e endereços IP #1290

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 6, 2025
+4 −4
Merged

Corrige validação de URL para permitir localhost e endereços IP #1290

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions src/api/integrations/event/webhook/webhook.controller.ts
View file
Original file line number Diff line number Diff line change
@@ -6,7 +6,6 @@ import { configService, Log, Webhook } from '@config/env.config';
import { Logger } from '@config/logger.config';
import { BadRequestException } from '@exceptions';
import axios, { AxiosInstance } from 'axios';
import { isURL } from 'class-validator';

import { EmitData, EventController, EventControllerInterface } from '../event.controller';

@@ -18,7 +17,7 @@ export class WebhookController extends EventController implements EventControlle
}

override async set(instanceName: string, data: EventDto): Promise<wa.LocalWebHook> {
if (!isURL(data.webhook.url, { require_tld: false })) {
if (!/^(https?:\/\/)/.test(data.webhook.url)) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question (bug_risk): Review the new URL validation logic using regex.

The previous implementation used isURL with specific options, which may have been more comprehensive. This regex only checks for the presence of a protocol prefix, so please ensure that this simplified check meets all your validation requirements.

throw new BadRequestException('Invalid "url" property');
}

@@ -78,6 +77,7 @@ export class WebhookController extends EventController implements EventControlle
const we = event.replace(/[.-]/gm, '_').toUpperCase();
const transformedWe = we.replace(/_/gm, '-').toLowerCase();
const enabledLog = configService.get<Log>('LOG').LEVEL.includes('WEBHOOKS');
const regex = /^(https?:\/\/)/;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suggestion: Consolidate URL validation logic.

Consider declaring and using a shared, well-documented constant for the URL validation regex across all methods. This will help avoid inconsistent usage, as the set method uses a literal regex while other parts rely on the declared variable.

Suggested implementation:

/**
 * Regex pattern for validating URLs starting with "http://" or "https://"
 */
const URL_VALIDATION_REGEX = /^(https?:\/\/)/;

// (Existing imports remain unchanged)
    if (!URL_VALIDATION_REGEX.test(data.webhook.url)) {
    // Removed local regex constant in favor of shared URL_VALIDATION_REGEX
          if (instance?.enabled && URL_VALIDATION_REGEX.test(instance.url)) {

Make sure that the new constant declaration is positioned appropriately (e.g. at the top of the file after the imports) and that no other part of the file uses a hard-coded regex. Adjust the location if your project's conventions require constants to be declared in a separate file.


const webhookData = {
event,
@@ -111,7 +111,7 @@ export class WebhookController extends EventController implements EventControlle
}

try {
if (instance?.enabled && isURL(instance.url, { require_tld: false })) {
if (instance?.enabled && regex.test(instance.url)) {
const httpService = axios.create({
baseURL,
headers: webhookHeaders as Record<string, string> | undefined,
@@ -155,7 +155,7 @@ export class WebhookController extends EventController implements EventControlle
}

try {
if (isURL(globalURL)) {
if (regex.test(globalURL)) {
const httpService = axios.create({ baseURL: globalURL });

await this.retryWebhookRequest(