Allow only https

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-02-13 15:54:05 +01:00
parent c163ca9bf0
commit c81205aaa1
3 changed files with 8 additions and 5 deletions

View File

@@ -163,12 +163,12 @@ const webhookFormSchema = z.object({
(val) => { (val) => {
try { try {
const url = new URL(val); const url = new URL(val);
return url.protocol === "http:" || url.protocol === "https:"; return url.protocol === "https:";
} catch { } catch {
return false; return false;
} }
}, },
"URL must use http:// or https://", "URL must use https://",
), ),
selectedEvents: z selectedEvents: z
.array(z.enum(WEBHOOK_EVENT_VALUES)) .array(z.enum(WEBHOOK_EVENT_VALUES))

View File

@@ -48,7 +48,7 @@ func (r *CreateWebhookConfigurationRequest) Validate() error {
v := validator.New() v := validator.New()
v.Check(r.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType)) v.Check(r.OrganizationID, "organization_id", validator.Required(), validator.GID(coredata.OrganizationEntityType))
v.Check(r.EndpointURL, "endpoint_url", validator.Required(), validator.URL()) v.Check(r.EndpointURL, "endpoint_url", validator.Required(), validator.HTTPSUrl())
return v.Error() return v.Error()
} }
@@ -57,7 +57,7 @@ func (r *UpdateWebhookConfigurationRequest) Validate() error {
v := validator.New() v := validator.New()
v.Check(r.WebhookConfigurationID, "webhook_configuration_id", validator.Required(), validator.GID(coredata.WebhookConfigurationEntityType)) v.Check(r.WebhookConfigurationID, "webhook_configuration_id", validator.Required(), validator.GID(coredata.WebhookConfigurationEntityType))
v.Check(r.EndpointURL, "endpoint_url", validator.NotEmpty(), validator.URL()) v.Check(r.EndpointURL, "endpoint_url", validator.NotEmpty(), validator.HTTPSUrl())
return v.Error() return v.Error()
} }

View File

@@ -323,7 +323,10 @@ func (s *Sender) recordEvent(
} }
err := s.pg.WithConn(ctx, func(conn pg.Conn) error { err := s.pg.WithConn(ctx, func(conn pg.Conn) error {
return event.Insert(ctx, conn, scope) if err := event.Insert(ctx, conn, scope); err != nil {
return fmt.Errorf("cannot insert webhook event: %w", err)
}
return nil
}) })
if err != nil { if err != nil {
s.logger.ErrorCtx(ctx, "cannot insert webhook event", s.logger.ErrorCtx(ctx, "cannot insert webhook event",