@@ -122,7 +123,7 @@ export default function SSOSettings() {
id="SpEntityId"
type={'text'}
className={'tracking-widest'}
- value={'https://getcoop.com'}
+ value={HOST_URL}
disabled
endSlot={
@@ -132,7 +133,7 @@ export default function SSOSettings() {
variant="white"
size="icon"
className="h-[2.875rem] rounded-none rounded-r-lg border-l-0"
- onClick={() => copyText('https://getcoop.com')}
+ onClick={() => copyText(HOST_URL)}
>
diff --git a/server/utils/url.test.ts b/server/utils/url.test.ts
index b8c6daf6..5b3a6a47 100644
--- a/server/utils/url.test.ts
+++ b/server/utils/url.test.ts
@@ -1,7 +1,7 @@
import { validateUrl } from './url.js';
describe('URL Tests', () => {
- describe('Deny Prod URLs', () => {
+ describe('Loopback gating (default)', () => {
beforeEach(() => {
// This absolutely is unsafe mutation of a global that'll be visible
// across test suites. However, this env var should only be relied upon
@@ -13,24 +13,18 @@ describe('URL Tests', () => {
delete process.env.ALLOW_USER_INPUT_LOCALHOST_URIS;
});
- test('Deny Coop domains', () => {
- expect(() => validateUrl('https://www.coopapi.com')).toThrow();
- expect(() => validateUrl('https://www.trycoop.co')).toThrow();
- expect(() => validateUrl('https://www.getcoop.com')).toThrow();
- });
-
test('Deny localhost domains', () => {
- // This absolutely is unsafe mutation of a global that'll be visible
- // across test suites. However, this env var should only be relied upon
- // by this module, so it should be ok.
- process.env.ALLOW_USER_INPUT_LOCALHOST_URIS = 'false';
-
expect(() => validateUrl('https://localhost:3000')).toThrow();
expect(() => validateUrl('https://127.0.0.1')).toThrow();
});
+
+ test('Allow arbitrary external URLs', () => {
+ expect(() => validateUrl('https://example.com')).not.toThrow();
+ expect(() => validateUrl('https://api.example.org/webhook')).not.toThrow();
+ });
});
- describe('Allow development URLs', () => {
+ describe('Loopback gating (development override)', () => {
beforeEach(() => {
// This absolutely is unsafe mutation of a global that'll be visible
// across test suites. However, this env var should only be relied upon
@@ -42,15 +36,20 @@ describe('URL Tests', () => {
delete process.env.ALLOW_USER_INPUT_LOCALHOST_URIS;
});
- test('Deny Coop domains', () => {
- expect(() => validateUrl('https://www.coopapi.com')).toThrow();
- expect(() => validateUrl('https://www.trycoop.co')).toThrow();
- expect(() => validateUrl('https://www.getcoop.com')).toThrow();
- });
-
test('Allow localhost domains', () => {
expect(() => validateUrl('https://localhost:3000')).not.toThrow();
expect(() => validateUrl('https://127.0.0.1')).not.toThrow();
});
});
+
+ describe('Caller-provided blockedHostnames', () => {
+ test('Honor custom blocklist passed via opts', () => {
+ expect(() =>
+ validateUrl('https://blocked.example.com', {
+ allowedSchemes: ['http', 'https'],
+ blockedHostnames: ['blocked.example.com'],
+ }),
+ ).toThrow();
+ });
+ });
});
diff --git a/server/utils/url.ts b/server/utils/url.ts
index a71434e6..36779ee1 100644
--- a/server/utils/url.ts
+++ b/server/utils/url.ts
@@ -10,17 +10,12 @@ type UrlValidationOptions = {
function defaultBlockedHostnames(): string[] {
const { ALLOW_USER_INPUT_LOCALHOST_URIS } = process.env;
- return [
- 'coopapi.com',
- 'www.coopapi.com',
- 'trycoop.co',
- 'www.trycoop.co',
- 'getcoop.com',
- 'www.getcoop.com',
- ...(ALLOW_USER_INPUT_LOCALHOST_URIS === 'true'
- ? []
- : ['localhost', '127.0.0.1']),
- ];
+ // Block loopback addresses to reduce SSRF risk from user-supplied URLs (e.g.
+ // webhook callbacks). Operators who want stricter blocking against their own
+ // public hostname should pass `blockedHostnames` via `UrlValidationOptions`.
+ return ALLOW_USER_INPUT_LOCALHOST_URIS === 'true'
+ ? []
+ : ['localhost', '127.0.0.1'];
}
export function validateUrl(