fix: add URL validation to webhook endpoints by pedroccastro · Pull Request #26593 · calcom/cal.com

pedroccastro · 2026-01-08T18:17:37Z

What does this PR do?

Adds URL validation to webhook endpoints to prevent SSRF attacks (malicious URLs pointing to internal networks, cloud
metadata endpoints, and localhost).

Existing webhooks are preserved: validation only applies when the URL is created or changed, allowing existing
HTTP webhooks to continue working.

Note: This PR depends on #26522 and should be merged after it.

Changes

Layer	File(s)	Change
Lib	`ssrfProtection.ts`	SSRF validation with ipaddr.js
tRPC	`edit.schema.ts`	Simple URL validation (no SSRF at schema level)
tRPC	`edit.handler.ts`	Conditional SSRF validation (only when URL changes)
API v2	`validate-webhook-url.ts`	Helper functions for SSRF validation
API v2	`*-webhooks.service.ts`	Validate on create; validate on update only if URL changes

Validation rules

HTTPS only (except self-hosted deployments)
Private IP ranges blocked (RFC1918, RFC6598, link-local, etc.)
Cloud metadata endpoints blocked (AWS, GCP, Azure)
Localhost/loopback blocked (except E2E tests)

Exceptions

Environment	HTTP	Private IPs	Cloud Metadata
Cal.com	No	No	No
Self-hosted	Yes	Yes	No
E2E tests	Yes (localhost only)	No	No

Grandfathering behavior

Action	URL changed?	Validation
Create webhook	N/A	Always validated
Update webhook	No	Skipped
Update webhook	Yes	Validated

Updates since last revision

Protocol restriction for self-hosted mode: Self-hosted deployments now only allow HTTP and HTTPS protocols. Previously, arbitrary protocols (file://, ftp://, etc.) could bypass validation. This addresses Cubic AI review feedback (confidence 9/10).

Breaking Changes Assessment

Existing users:

Existing webhooks continue working (validation only on create/URL change)
Self-hosted deployments can still use HTTP webhooks
E2E tests work with localhost receivers

New restrictions (Cal.com only):

New webhooks require HTTPS
Cannot change existing webhook URL to HTTP/private IP

How should this be tested?

Create webhook with https://example.com/hook → ✓ works
Create webhook with http://example.com/hook → X rejected
Create webhook with https://localhost/hook → X rejected
Create webhook with https://10.0.0.1/hook → X rejected
Edit existing HTTP webhook (change active only) → ✓ works (grandfathered)
Edit existing HTTP webhook (change URL to another HTTP) → X rejected
Self-hosted deployment → HTTP webhooks allowed
Self-hosted deployment → file:// or ftp:// URLs rejected

Human Review Checklist

Verify protocol check in ssrfProtection.ts:137-139 correctly restricts self-hosted to HTTP/HTTPS only
Confirm E2E localhost exception (NEXT_PUBLIC_IS_E2E) cannot be exploited in production
Review IPv6 bracket stripping logic for edge cases

Mandatory Tasks

I have self-reviewed the code
N/A I have updated the developer docs
I confirm automated tests are in place

cubic-dev-ai

4 issues found across 16 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/lib/ssrfProtection.ts">

<violation number="1" location="packages/lib/ssrfProtection.ts:138">
P0: IPv6 addresses bypass private IP validation because `URL.hostname` includes brackets for IPv6 (e.g., `[::1]`), but `net.isIP('[::1]')` returns 0 due to brackets. This allows requests to private IPv6 addresses like `https://[::1]/` (localhost) to pass validation. Strip brackets before checking.</violation>

<violation number="2" location="packages/lib/ssrfProtection.ts:203">
P2: Rule violated: **Avoid Logging Sensitive Information**

URL logged may contain sensitive data (API keys, tokens, or basic auth credentials in query parameters). Consider sanitizing the URL to log only the hostname and path, or redact query parameters before logging.</violation>
</file>

<file name="apps/api/v2/src/modules/teams/teams/inputs/update-team.input.ts">

<violation number="1" location="apps/api/v2/src/modules/teams/teams/inputs/update-team.input.ts:21">
P2: Replacing `@IsUrl()` with `@IsString()` + `@Validate(SSRFSafeUrlValidator)` allows empty strings to pass validation. The `SSRFSafeUrlValidator` uses `if (!url) return true;` which treats empty string as valid (since `!''` is truthy), whereas `@IsUrl()` would reject empty strings. Consider adding `@IsNotEmpty()` decorator or fixing the validator to check `url === undefined || url === null` instead of `!url`.</violation>
</file>

<file name="apps/api/v2/src/modules/webhooks/validators/webhookUrlValidator.ts">

<violation number="1" location="apps/api/v2/src/modules/webhooks/validators/webhookUrlValidator.ts:20">
P1: Security mismatch: Code uses `allowHttp: true` but PR description specifies "HTTPS only" and testing instructions say HTTP should be rejected. If HTTP should be blocked per security requirements, change to `allowHttp: false`. If HTTP is intentionally allowed, update the PR description and testing instructions to reflect the actual behavior.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/lib/ssrfProtection.ts

apps/api/v2/src/modules/webhooks/validators/webhookUrlValidator.ts

apps/api/v2/src/modules/teams/teams/inputs/update-team.input.ts

packages/lib/ssrfProtection.ts

vercel · 2026-01-08T20:17:41Z

The latest updates on your projects. Learn more about Vercel for GitHub.

4 Skipped Deployments

Project	Deployment	Review	Updated (UTC)
api-v2	Ignored	Preview	Jan 10, 2026 10:59am
cal	Ignored		Jan 10, 2026 10:59am
cal-companion	Ignored	Preview	Jan 10, 2026 10:59am
cal-eu	Ignored		Jan 10, 2026 10:59am

Add URL validation to webhook endpoints to prevent malicious URLs pointing to internal networks, cloud metadata endpoints, and localhost - Add URL validation schema for tRPC webhook endpoints - Add WebhookUrlValidator for API v2 NestJS endpoints - Apply validation to create, edit, and testTrigger endpoints Security: Only HTTPS allowed. Blocks private IPs (RFC1918, RFC6598), localhost, and cloud metadata endpoints (AWS, GCP, Azure)

- Fix IPv6 bypass: strip brackets before IP check (e.g., [::1] -> ::1) - Sanitize URLs in logs: remove query params that may contain secrets - Add tests for IPv6 private addresses with brackets

hariombalhara

Small non-blocking suggestions

packages/lib/zod/ssrfSafeUrl.ts

packages/lib/ssrfProtection.ts

- Replace manual regex patterns with ipaddr.js library for robust IP validation - Fix IPv6 bypass vulnerability where bracketed addresses ([::1]) were not blocked - Add reserved and benchmarking IP ranges to blocklist - Remove unused allowHttp option (HTTPS-only policy) - DRY refactor Zod URL schemas

volnei

Small comment. Rest looks good 🚀

apps/api/v2/src/modules/webhooks/inputs/webhook.input.ts

github-actions · 2026-01-21T00:29:08Z

This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active.

- tRPC: validate URL change in edit.handler.ts instead of schema - API v2: validate in services using shared utility functions - Remove unused WebhookUrlValidator class-validator decorator - Add DRY helpers: validateWebhookUrl, validateWebhookUrlIfChanged

cubic-dev-ai

2 issues found across 15 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/api/v2/src/modules/webhooks/services/webhooks.service.ts">

<violation number="1" location="apps/api/v2/src/modules/webhooks/services/webhooks.service.ts:11">
P2: Fetch only `subscriberUrl` instead of loading the entire webhook row. The new call introduces a full-row Prisma read for a single field, which is against the select-only guidance and increases data exposure.</violation>
</file>

<file name="packages/lib/zod/ssrfSafeUrl.ts">

<violation number="1" location="packages/lib/zod/ssrfSafeUrl.ts:36">
P2: The new non-nullable optional schema still accepts an empty string because it reuses validateSsrfUrl. That allows clearing the URL with "" without SSRF validation, which defeats the intent of a non-nullable update field.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

apps/api/v2/src/modules/webhooks/services/webhooks.service.ts

packages/lib/zod/ssrfSafeUrl.ts

github-actions · 2026-01-22T14:06:35Z

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

- Use select-only query for subscriberUrl comparison (reduces data exposure) - Reject empty string in non-nullable URL schema

…lient bundle)

github-actions · 2026-02-03T02:34:34Z

E2E results are ready!

Workflow #102568.1 latest results

paragon-review · 2026-02-03T18:39:57Z

Paragon: tests updated

1 updated test generated for this PR.

Updated Tests

HTTP webhook exceptions for self-hosted deployments — Adding new test to existing file

Details

Updated Tests

HTTP webhook exceptions for self-hosted deployments (unit)

paragon-review · 2026-02-03T19:32:33Z

Paragon: tests updated

1 new test and 1 updated test generated for this PR.

New Tests

validate-webhook-url.spec.ts - Webhook URL validation utility tests — Tests for the new validate-webhook-url.ts utility that provides validateWebhookUrl and validateWebhookUrlIfChanged functions used by webhook services.

Updated Tests

ssrfProtection.test.ts - Self-hosted behavior tests — Adding new test to existing file

Details

New Tests

validate-webhook-url.spec.ts - Webhook URL validation utility tests (unit)

Updated Tests

ssrfProtection.test.ts - Self-hosted behavior tests (unit)

cubic-dev-ai

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/lib/ssrfProtection.ts">

<violation number="1" location="packages/lib/ssrfProtection.ts:134">
P1: Self-hosted mode allows arbitrary protocols (file://, ftp://, etc.) instead of restricting to HTTP/HTTPS. According to the PR's validation rules, self-hosted should allow HTTP, but this allows all protocols. Consider adding a protocol check before returning valid.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/lib/ssrfProtection.ts

…l.spec.ts Generated by Paragon from proposal for PR #26593

Generated by Paragon from proposal for PR #26593

pedroccastro · 2026-02-03T19:34:25Z

🧪 Tests Added by Paragon

The following test files have been added to this PR:

apps/api/v2/src/modules/webhooks/utils/validate-webhook-url.spec.ts
packages/lib/ssrfProtection.test.ts

These tests were generated from an approved test proposal.

Generated with Paragon

github-actions · 2026-02-03T19:34:33Z

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

Address Cubic AI review feedback (confidence 9/10): Self-hosted mode was allowing arbitrary protocols (file://, ftp://, etc.) instead of restricting to HTTP/HTTPS. Added protocol check before returning valid for self-hosted deployments. Co-Authored-By: unknown <>

emrysal

Awesome, small NIT; but non-blocking; otherwise approved.

emrysal · 2026-02-05T16:31:23Z

apps/api/v2/src/modules/webhooks/utils/validate-webhook-url.ts

+  }
+}
+
+export function validateWebhookUrlIfChanged(


NIT: I prefer assert naming for throwing functions like this.

pull-request-size bot added the size/XL label Jan 8, 2026

pedroccastro marked this pull request as ready for review January 8, 2026 19:46

pedroccastro requested review from a team as code owners January 8, 2026 19:46

graphite-app bot added foundation core area: core, team members only labels Jan 8, 2026

cubic-dev-ai bot reviewed Jan 8, 2026

View reviewed changes

pedroccastro force-pushed the fix/webhook-url-validation branch from aa55415 to 148e550 Compare January 8, 2026 20:17

pedroccastro added 2 commits January 8, 2026 19:18

fix: address review feedback

8e220c7

- Fix IPv6 bypass: strip brackets before IP check (e.g., [::1] -> ::1) - Sanitize URLs in logs: remove query params that may contain secrets - Add tests for IPv6 private addresses with brackets

pedroccastro force-pushed the fix/webhook-url-validation branch from 148e550 to 8e220c7 Compare January 8, 2026 22:45

pull-request-size bot added size/L and removed size/XL labels Jan 8, 2026

vercel bot had a problem deploying to Preview – dev January 10, 2026 11:44 Failure

Udit-takkar previously approved these changes Jan 12, 2026

View reviewed changes

Merge branch 'main' into fix/webhook-url-validation

f718083

Udit-takkar enabled auto-merge (squash) January 12, 2026 08:16

hariombalhara previously approved these changes Jan 12, 2026

View reviewed changes

packages/lib/zod/ssrfSafeUrl.ts Outdated Show resolved Hide resolved

packages/lib/ssrfProtection.ts Show resolved Hide resolved

pedroccastro dismissed stale reviews from hariombalhara and Udit-takkar via 0abf659 January 13, 2026 00:36

Merge branch 'main' into fix/webhook-url-validation

9426bbb

volnei reviewed Jan 13, 2026

View reviewed changes

apps/api/v2/src/modules/webhooks/inputs/webhook.input.ts Outdated Show resolved Hide resolved

pedroccastro marked this pull request as draft January 13, 2026 03:40

auto-merge was automatically disabled January 13, 2026 03:40
Pull request was converted to draft

vercel bot temporarily deployed to Preview – cal-companion January 13, 2026 08:55 Inactive

vercel bot temporarily deployed to Preview – dev January 13, 2026 08:55 Inactive

github-actions bot added the Stale label Jan 21, 2026

github-actions bot removed the Stale label Jan 22, 2026

chore: remove trailing whitespace

8c9ee1c

pedroccastro marked this pull request as ready for review January 22, 2026 14:01

cubic-dev-ai bot reviewed Jan 22, 2026

View reviewed changes

apps/api/v2/src/modules/webhooks/services/webhooks.service.ts Outdated Show resolved Hide resolved

packages/lib/zod/ssrfSafeUrl.ts Outdated Show resolved Hide resolved

pedroccastro added 2 commits February 2, 2026 11:38

Merge branch 'main' into fix/webhook-url-validation

772bac1

fix: address review feedback for webhook SSRF validation

c94e192

- Use select-only query for subscriberUrl comparison (reduces data exposure) - Reject empty string in non-nullable URL schema

pedroccastro added the ready-for-e2e label Feb 2, 2026

pedroccastro added 4 commits February 2, 2026 12:50

Merge branch 'main' into fix/webhook-url-validation

cf7cebb

fix: adjust getWebhookSubscriberUrl response type

9bfb39c

fix: move SSRF validation from schema to handler (avoid node:dns in c…

009b04c

…lient bundle)

Merge branch 'main' into fix/webhook-url-validation

a1e1364

pedroccastro added 3 commits February 3, 2026 13:20

fix: allow localhost webhooks in E2E tests

06b6eb6

Merge branch 'main' into fix/webhook-url-validation

eff1971

fix: allow HTTP webhooks in E2E tests and self-hosted

5b6dd97

fix: allow private IPs for self-hosted, block cloud metadata for all

f79a90e

cubic-dev-ai bot reviewed Feb 3, 2026

View reviewed changes

packages/lib/ssrfProtection.ts Show resolved Hide resolved

pedroccastro added 2 commits February 3, 2026 16:34

Add tests: apps/api/v2/src/modules/webhooks/utils/validate-webhook-ur…

811ee06

…l.spec.ts Generated by Paragon from proposal for PR #26593

Add tests: packages/lib/ssrfProtection.test.ts

96b87d3

Generated by Paragon from proposal for PR #26593

devin-ai-integration bot and others added 2 commits February 3, 2026 19:39

fix: convert validate-webhook-url.spec.ts from Vitest to Jest

8bca27f

emrysal approved these changes Feb 5, 2026

View reviewed changes

pedroccastro merged commit cb36fc2 into main Feb 5, 2026
89 of 92 checks passed

pedroccastro deleted the fix/webhook-url-validation branch February 5, 2026 19:18

Conversation

pedroccastro commented Jan 8, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Changes

Validation rules

Exceptions

Grandfathering behavior

Updates since last revision

Breaking Changes Assessment

How should this be tested?

Human Review Checklist

Mandatory Tasks

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

vercel bot commented Jan 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hariombalhara left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

volnei left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jan 21, 2026

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented Jan 22, 2026

Devin AI is addressing Cubic AI's review feedback

Uh oh!

github-actions bot commented Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

E2E results are ready!

Uh oh!

paragon-review bot commented Feb 3, 2026

Paragon: tests updated

Updated Tests

Uh oh!

paragon-review bot commented Feb 3, 2026

Paragon: tests updated

New Tests

Updated Tests

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pedroccastro commented Feb 3, 2026

🧪 Tests Added by Paragon

Uh oh!

github-actions bot commented Feb 3, 2026

Devin AI is addressing Cubic AI's review feedback

Uh oh!

emrysal left a comment

Choose a reason for hiding this comment

Uh oh!

emrysal Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

pedroccastro commented Jan 8, 2026 •

edited by devin-ai-integration bot

Loading

vercel bot commented Jan 8, 2026 •

edited

Loading

github-actions bot commented Feb 3, 2026 •

edited

Loading