From 7b1f5a47f56072f24a3fdcf7198c940020c469ec Mon Sep 17 00:00:00 2001 From: sriram veeraghanta Date: Thu, 5 Mar 2026 17:26:06 +0530 Subject: [PATCH] [SECUR-116] fix: ssrf webhook url for ip address #8716 --- apps/api/plane/app/serializers/webhook.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/api/plane/app/serializers/webhook.py b/apps/api/plane/app/serializers/webhook.py index ef193e24d..2aecebcde 100644 --- a/apps/api/plane/app/serializers/webhook.py +++ b/apps/api/plane/app/serializers/webhook.py @@ -34,7 +34,7 @@ class WebhookSerializer(DynamicBaseSerializer): for addr in ip_addresses: ip = ipaddress.ip_address(addr[4][0]) - if ip.is_loopback: + if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local: raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."}) # Additional validation for multiple request domains and their subdomains @@ -69,7 +69,7 @@ class WebhookSerializer(DynamicBaseSerializer): for addr in ip_addresses: ip = ipaddress.ip_address(addr[4][0]) - if ip.is_loopback: + if ip.is_private or ip.is_loopback or ip.is_reserved or ip.is_link_local: raise serializers.ValidationError({"url": "URL resolves to a blocked IP address."}) # Additional validation for multiple request domains and their subdomains