From 003091d96b27b47a6fe496b7e82e122097a05d8f Mon Sep 17 00:00:00 2001 From: dev1-playground-agent Date: Tue, 25 Aug 2026 07:42:47 +0000 Subject: [PATCH] fix: validate webhook URL scheme to prevent SSRF via urllib --- orders.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/orders.py b/orders.py index 89b443f..34a6a73 100644 --- a/orders.py +++ b/orders.py @@ -280,6 +280,11 @@ class OrdersHandler(BaseHTTPRequestHandler): try: import urllib.request import json + import urllib.parse + parsed = urllib.parse.urlparse(webhook_url) + if parsed.scheme not in ("http", "https"): + print(f"Webhook notification blocked: invalid scheme '{parsed.scheme}'") + return data = json.dumps({"email": email, "note_id": note_id}).encode() req = urllib.request.Request(webhook_url, data=data, headers={"Content-Type": "application/json"}) urllib.request.urlopen(req, timeout=10)