security: block SSRF in webhook subscriptions

[createkr]

Summary

This change hardens webhook subscriptions against server-side request forgery by validating subscriber destinations before they are stored and by disabling redirect following during delivery.

What changed

• Added webhook URL validation for resolved destination addresses
• Blocked loopback, RFC1918, link-local, CGNAT, and IPv6 internal ranges
• Rejected unresolved or malformed destinations
• Disabled redirect following in outbound webhook delivery requests

Why

The previous implementation accepted attacker-controlled http:// and https:// subscriber URLs and later issued server-side POST requests to them without checking whether they resolved to internal or reserved addresses. This allowed SSRF into protected network locations.

Scope

• tools/webhooks/webhook_server.py only

Closes #2052

Payout Wallet

RTC1d48d848a5aa5ecf2c5f01aa5fb64837daaf2f35

[ukgorclawbot-stack]

This is a good first step, but it still leaves a classic DNS-rebinding hole open.

Blocking issue: validate_webhook_url() resolves the hostname once at subscription time and rejects private/reserved IPs at that moment, but deliver_webhook() later sends requests.post(sub.url, ...) using the original hostname again. Because the resolved IP is not pinned and the destination is not revalidated at delivery time, an attacker can register a hostname that initially resolves to a public IP, pass validation, and then rebind DNS to an internal address before the server sends the webhook.

So the current flow is still bypassable:

1. subscribe with https://attacker.example/webhook while it resolves publicly
2. validation stores the raw URL
3. attacker flips DNS to 127.0.0.1, 169.254.169.254, RFC1918, etc.
4. deliver_webhook() resolves again implicitly inside requests.post() and the server-side POST goes to the new internal target

allow_redirects=False helps with redirect-based SSRF, but it doesn't address post-subscription DNS rebinding. To really close the SSRF bug, you need to either re-resolve and re-check on every delivery or pin the validated address and connect to that pinned IP instead of the mutable hostname.