Arnaud
5a9e306357
Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI url-import and webhook dispatch (new safeFetch with IP-pinned undici dispatcher); cross-user photo deletion via unvalidated recipe/review storage keys; comment-moderation and tier-quota checks trusting a stale cached session role/tier instead of the DB. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
65 lines
2.0 KiB
TypeScript
65 lines
2.0 KiB
TypeScript
import crypto from "crypto";
|
|
import { db } from "@epicure/db";
|
|
import { webhooks, webhookDeliveries } from "@epicure/db";
|
|
import { eq, and } from "@epicure/db";
|
|
import { safeFetch } from "@/lib/validate-webhook-url";
|
|
|
|
export const WEBHOOK_EVENTS = [
|
|
"recipe.created",
|
|
"recipe.updated",
|
|
"recipe.published",
|
|
"recipe.deleted",
|
|
"meal_plan.updated",
|
|
"shopping_list.completed",
|
|
"comment.added",
|
|
] as const;
|
|
|
|
export type WebhookEvent = (typeof WEBHOOK_EVENTS)[number];
|
|
|
|
export async function dispatchWebhook(userId: string, event: WebhookEvent, payload: object) {
|
|
const hooks = await db
|
|
.select()
|
|
.from(webhooks)
|
|
.where(and(eq(webhooks.userId, userId), eq(webhooks.active, true)));
|
|
|
|
const filtered = hooks.filter((h) => h.events.length === 0 || h.events.includes(event));
|
|
|
|
await Promise.allSettled(
|
|
filtered.map(async (hook) => {
|
|
const body = JSON.stringify({ event, payload, timestamp: new Date().toISOString() });
|
|
const sig = crypto.createHmac("sha256", hook.secret).update(body).digest("hex");
|
|
let statusCode = 0;
|
|
let success = false;
|
|
try {
|
|
// safeFetch resolves and pins the connection to a single validated IP
|
|
// (and re-validates + re-pins every redirect hop), so there's no
|
|
// separate re-resolution for a rebinding attack to exploit.
|
|
const res = await safeFetch(hook.url, {
|
|
method: "POST",
|
|
headers: {
|
|
"Content-Type": "application/json",
|
|
"X-Epicure-Signature": `sha256=${sig}`,
|
|
"X-Epicure-Event": event,
|
|
},
|
|
body,
|
|
signal: AbortSignal.timeout(10000),
|
|
});
|
|
statusCode = res.status;
|
|
success = res.ok;
|
|
} catch {
|
|
// delivery failed; statusCode stays 0, success stays false
|
|
}
|
|
await db.insert(webhookDeliveries).values({
|
|
id: crypto.randomUUID(),
|
|
webhookId: hook.id,
|
|
event,
|
|
payload: payload as Record<string, unknown>,
|
|
statusCode,
|
|
success,
|
|
attempts: 1,
|
|
createdAt: new Date(),
|
|
});
|
|
})
|
|
);
|
|
}
|