fix(security): address GitHub issues #30 and #31 (webhook SSRF, config logging)#41
Merged
Merged
Conversation
- Validate context.callbackUrl before persisting (https only, no URL credentials, block private/reserved IPs; DNS-resolve hosts and check all A/AAAA targets). Optional RELAYX_CALLBACK_ALLOW_LOOPBACK and RELAYX_CALLBACK_SKIP_SSRF_CHECKS for dev/test. - Webhook POST uses a shared reqwest client with redirects disabled and connect/send timeouts (issue #30). - Remove derived Debug from Config; implement fmt::Debug with redacted relayer_private_key and sentry_dsn; add log_summary_for_tracing for startup logging (issue #31). - Enable tokio net for lookup_host; document env vars in README. Fixes #30. Fixes #31.
…onfig - Replace redundant matches!(bool, true) with a small env_truthy helper (clippy::redundant_pattern_matching under -D warnings). - Add .circleci/config.yml noop job so the linked CircleCI project stops failing with "no configuration found" until the app is disabled.
Member
There was a problem hiding this comment.
is this only a fallback until CI is connected to circle ?
Resolve callback.rs: keep OKX transaction-status webhook from master and the shared reqwest client (no redirects, timeouts) from the security branch.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #30 (SSRF / unsafe outbound webhooks) and #31 (secrets in
ConfigDebug/ startup logs).#30 — Callback URL hardening
utils::callback_security::validate_outbound_webhook_url, invoked fromprocess_single_transactionbefore the job is stored.tokio::net::lookup_hostand reject if any resolved address is disallowed.RELAYX_CALLBACK_ALLOW_LOOPBACK,RELAYX_CALLBACK_SKIP_SSRF_CHECKS.reqwest::Clientfor webhooks: no redirects, 30s total / 10s connect timeout.#31 — Secret-safe logging
#[derive(Debug)]fromConfig; added manualimpl fmt::Debugthat prints<redacted>/<none>forrelayer_private_keyandsentry_dsn.tracing::debug!("Configuration: {:?}", config)withlog_summary_for_tracing()(no secret material).Testing
cargo test(all green).Fixes #30. Fixes #31.