Sony MathewandGitHub
c8e551820b
This routes external downloads used by webhook fetch used by macros and acutomations through SafeFetch. It closes the SSRF exposure from raw Down.download paths, preserves provider-specific auth and header flows, and adds regression coverage for blocked internal URLs plus authenticated downloads. Fixes # (issue): [CW-6940](https://linear.app/chatwoot/issue/CW-6940/ssrf-via-webhooksautomationmacros-non-upload-non-avatar)
17 lines
870 B
Ruby
17 lines
870 B
Ruby
class AgentBots::WebhookJob < WebhookJob
|
|
queue_as :high
|
|
retry_on Webhooks::Trigger::RetryableError, wait: 3.seconds, attempts: 3 do |job, error|
|
|
url, payload, webhook_type = job.arguments
|
|
kwargs = job.arguments.last.is_a?(Hash) ? job.arguments.last : {}
|
|
Webhooks::Trigger.new(url, payload, webhook_type || :agent_bot_webhook, secret: kwargs[:secret],
|
|
delivery_id: kwargs[:delivery_id]).handle_failure(error)
|
|
end
|
|
|
|
def perform(url, payload, webhook_type = :agent_bot_webhook, secret: nil, delivery_id: nil)
|
|
super(url, payload, webhook_type, secret: secret, delivery_id: delivery_id)
|
|
rescue Webhooks::Trigger::RetryableError => e
|
|
Rails.logger.warn("[AgentBots::WebhookJob] attempt #{executions} failed #{e.class.name} payload=#{payload.to_json}")
|
|
raise
|
|
end
|
|
end
|