From c81205aaa14291c0bd613d225ceb490b0a2729da Mon Sep 17 00:00:00 2001 From: Sacha Al Himdani Date: Fri, 13 Feb 2026 15:54:05 +0100 Subject: [PATCH] Allow only https Signed-off-by: Sacha Al Himdani --- .../pages/organizations/settings/WebhooksSettingsPage.tsx | 4 ++-- pkg/probo/webhook_configuration_service.go | 4 ++-- pkg/webhook/sender.go | 5 ++++- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/apps/console/src/pages/organizations/settings/WebhooksSettingsPage.tsx b/apps/console/src/pages/organizations/settings/WebhooksSettingsPage.tsx index 499f3df51..e403a2ca4 100644 --- a/apps/console/src/pages/organizations/settings/WebhooksSettingsPage.tsx +++ b/apps/console/src/pages/organizations/settings/WebhooksSettingsPage.tsx @@ -163,12 +163,12 @@ const webhookFormSchema = z.object({ (val) => { try { const url = new URL(val); - return url.protocol === "http:" || url.protocol === "https:"; + return url.protocol === "https:"; } catch { return false; } }, - "URL must use http:// or https://", + "URL must use https://", ), selectedEvents: z .array(z.enum(WEBHOOK_EVENT_VALUES)) diff --git a/pkg/probo/webhook_configuration_service.go b/pkg/probo/webhook_configuration_service.go index 2b404b5f8..0a86d922d 100644 --- a/pkg/probo/webhook_configuration_service.go +++ b/pkg/probo/webhook_configuration_service.go @@ -48,7 +48,7 @@ func (r *CreateWebhookConfigurationRequest) Validate() error { v := validator.New() v.Check(r.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType)) - v.Check(r.EndpointURL, "endpoint_url", validator.Required(), validator.URL()) + v.Check(r.EndpointURL, "endpoint_url", validator.Required(), validator.HTTPSUrl()) return v.Error() } @@ -57,7 +57,7 @@ func (r *UpdateWebhookConfigurationRequest) Validate() error { v := validator.New() v.Check(r.WebhookConfigurationID, "webhook_configuration_id", validator.Required(), validator.GID(coredata.WebhookConfigurationEntityType)) - v.Check(r.EndpointURL, "endpoint_url", validator.NotEmpty(), validator.URL()) + v.Check(r.EndpointURL, "endpoint_url", validator.NotEmpty(), validator.HTTPSUrl()) return v.Error() } diff --git a/pkg/webhook/sender.go b/pkg/webhook/sender.go index 0344c1084..ae82e03e3 100644 --- a/pkg/webhook/sender.go +++ b/pkg/webhook/sender.go @@ -323,7 +323,10 @@ func (s *Sender) recordEvent( } err := s.pg.WithConn(ctx, func(conn pg.Conn) error { - return event.Insert(ctx, conn, scope) + if err := event.Insert(ctx, conn, scope); err != nil { + return fmt.Errorf("cannot insert webhook event: %w", err) + } + return nil }) if err != nil { s.logger.ErrorCtx(ctx, "cannot insert webhook event",