rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
coolify/app
History
Andras Bacsai 0b8c75f8ed fix(webhooks): add validation to block unsafe webhook URLs 
Prevent server-side request forgery (SSRF) attacks by validating webhook URLs before sending requests. Blocks loopback addresses, cloud metadata endpoints, and localhost URLs.

- Add SafeWebhookUrl rule validation in SendWebhookJob.handle()
- Log warning when unsafe URLs are rejected
- Add comprehensive unit tests covering valid and invalid URL scenarios
2026-03-28 14:23:08 +01:00
..
Actions refactor: simplify remote process chain and harden ActivityMonitor 2026-03-26 13:26:16 +01:00
Console feat(sync): sync install.sh, docker-compose, and env files to GitHub 2026-03-25 07:07:22 +01:00
Contracts
Data refactor: simplify remote process chain and harden ActivityMonitor 2026-03-26 13:26:16 +01:00
Enums
Events Make proxy restart run as background job to prevent localhost lockout 2025-12-03 10:30:12 +01:00
Exceptions feat(api): Improve OpenAPI spec and add rate limit handling for Hetzner 2025-12-11 12:12:43 +01:00
Helpers fix(ssh): handle chmod failures gracefully and simplify key management 2026-03-16 21:27:10 +01:00
Http refactor: split invitation endpoint into GET (show) and POST (accept) 2026-03-26 14:30:27 +01:00
Jobs fix(webhooks): add validation to block unsafe webhook URLs 2026-03-28 14:23:08 +01:00
Listeners fix(proxy): defer UI refresh until Traefik version check completes 2025-12-27 15:16:58 +01:00
Livewire fix: add URL validation for notification webhook fields 2026-03-28 12:22:59 +01:00
Models fix(storage): use escapeshellarg for volume names in shell commands 2026-03-26 11:06:30 +01:00
Notifications Fix: Allow test emails to be sent to any email address 2025-12-12 11:12:19 +01:00
Policies chore: prepare for PR 2026-02-25 11:18:46 +01:00
Providers Remove webhook maintenance mode replay feature 2025-12-02 13:36:32 +01:00
Repositories
Rules fix: add URL validation for notification webhook fields 2026-03-28 12:22:59 +01:00
Services refactor: remove verbose logging and use explicit exception types 2026-03-20 15:57:26 +01:00
Support fix(storage): use escapeshellarg for volume names in shell commands 2026-03-26 11:06:30 +01:00
Traits feat(deployment): add command_hidden flag to hide command text in logs 2026-03-25 16:48:49 +01:00
View/Components feat: add availableSharedVariables method and enhance env-var-input component for better password handling 2025-11-27 10:23:46 +01:00