paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(workflows): wire a real, SSRF-guarded webhook action (was a silent no-op)

Browse Source 
Second-review loose end: the `webhook` node type passed validation but had no
registered handler → engine dispatched to registry.getAction('webhook') →
undefined → every run silently skipped. An enabled webhook flow no-op'd.

Register a real `webhook` action (covers both the webhook node type and the
"Call a webhook" action). It POSTs the run context to config.url, guarded by
validateExternalUrl — the same NAT64/private-range SSRF protection the webhook
delivery worker uses (GHSA-wmjx-pc37-272r) — with no redirects and a timeout,
unless WEBHOOK_ALLOW_PRIVATE_URLS=true (local-dev opt-out). Missing URL /
rejected URL / network error record an observable skipped step, not a crash.
So the action is now implemented → it passes the enable guard legitimately.

Test covers dry-run, missing-url, and metadata-IP (169.254.169.254) rejection.
This commit is contained in:
Luca
2026-06-25 18:00:12 +02:00
parent 415c93a512
commit af7eea8b43
2 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/__tests__/integration/workflowEngine.test.js
+18
View File
@@ -415,6 +415,24 @@ describe('workflow engine', () => {
expect(await _internal.resolveTemplateKey('zzznotype', 'promo_')).toBe('promo_default');
});
test('webhook action: dry-run, missing url, and SSRF-guarded private/metadata url', async () => {
const webhook = engine.registry.getAction('webhook');
expect(typeof webhook).toBe('function'); // registered — no longer a silent no-op
const ctx = (config, vars = {}) => ({
run: { id: 1, workflow_id: 1, version: 1, trigger_event: 't', entity_type: 'x', entity_id: 1 },
node: { config }, vars, db, logger: { warn() {} },
});
// Dry run never calls out.
expect(await webhook(ctx({ url: 'https://example.com/hook' }, { __dryRun: true })))
.toMatchObject({ dryRun: true, would: 'webhook' });
// No URL → observable skip, not a crash.
expect(await webhook(ctx({}))).toMatchObject({ skipped: true });
// SSRF: cloud-metadata / private target rejected before any request.
const r = await webhook(ctx({ url: 'http://169.254.169.254/latest/meta-data' }));
expect(r.skipped).toBe(true);
expect(r.reason).toMatch(/rejected/i);
});
test('isBuiltinFlowActive reflects the built-in ENABLED state (enabled-based mutex)', async () => {
const { seedBuiltinWorkflowsAtBoot } = require('../../src/services/_workflowSeedBoot');
await seedBuiltinWorkflowsAtBoot(db, { info() {}, warn() {} });