fix(webhook): require literal host in url-template (WHK-04)

[olucasandrade]

Plan

.claude/fix-plans/webhook-url-template-ssrf-20260924-212132.md

Problem

url-template values could place event/row fields in the URL authority. At render time only http/https was required, so a writer to a replicated table could steer delivery — including precomputed Authorization and the full event payload — to an attacker-controlled or cloud-metadata host.

Introduced by

3ed66d7

Implementation

• WHK-04: webhook url-template may be data-driven only in path/query; host/userinfo must be a literal validated at startup (reject authority containing {{ or {%).
• After render, request host must exactly match the startup-validated host; otherwise return a permanent error — do not dial and do not attach Authorization (also checked in doRequest as defense-in-depth).
• Literal host + data-driven path continues to work. Actions that compile into webhook configs inherit this via the same sink (ACT-01); no second delivery path.
• Kept the check inside internal/output/webhook (no internal/enrich import; depguard unchanged).

Validation

CGO_ENABLED=0 go test ./internal/output/webhook -count=1

Pass. Coverage includes: startup rejects {{host}} in authority; host mismatch does not dial / does not attach auth; literal host + path templates still deliver.

Residual risk

• Intentional multi-tenant templates that vary host by row data are no longer supported (operators must use a fixed host).
• No private-IP / metadata DNS blocklist was added; literal-host pinning is the primary control. Redirects remain disabled (WHK-02).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 76fbc73c-5fda-418c-b8f5-e6290ca04342

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying kaptanto with    Cloudflare Pages

Latest commit:	063ea02
Status:	✅  Deploy successful!
Preview URL:	https://d2e3923c.kaptanto.pages.dev
Branch Preview URL:	https://fix-webhook-url-template-ssr.kaptanto.pages.dev

View logs