From 71b0d30afbab666dfd1ef66bc2c07e9363580cd6 Mon Sep 17 00:00:00 2001 From: sriram veeraghanta Date: Thu, 5 Mar 2026 17:26:06 +0530 Subject: [PATCH] [SECUR-116] fix: ssrf webhook url for ip address #8716 --- apps/api/plane/app/serializers/webhook.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/api/plane/app/serializers/webhook.py b/apps/api/plane/app/serializers/webhook.py index 7ec3dba5a..74ebde892 100644 --- a/apps/api/plane/app/serializers/webhook.py +++ b/apps/api/plane/app/serializers/webhook.py @@ -38,7 +38,7 @@ class WebhookSerializer(DynamicBaseSerializer): for addr in ip_addresses: ip = ipaddress.ip_address(addr[4][0]) - if ip.is_loopback: + if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local: raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."}) # Additional validation for multiple request domains and their subdomains @@ -73,7 +73,7 @@ class WebhookSerializer(DynamicBaseSerializer): for addr in ip_addresses: ip = ipaddress.ip_address(addr[4][0]) - if ip.is_loopback: + if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local: raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."}) # Additional validation for multiple request domains and their subdomains