Bunsink has an SSRF bypass in `validate_webhook_url`

@@ -1,10 +1,25 @@
 import ipaddress
 import socket
-from urllib.parse import urlparse
+
+import requests
+from requests import RequestException
+from urllib3.exceptions import LocationParseError
+
+from urllib3.util import parse_url as parse_url_from_urllib3
 
 from bugsink.app_settings import get_settings
 
 
+_URL_ALLOWED_CHARACTERS = set(
+    "abcdefghijklmnopqrstuvwxyz" +
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +  # ASCII letters
+    "0123456789" +  # ASCII digits
+    "-._~" +  # RFC 3986 unreserved marks
+    ":/?#[]@" +  # RFC 3986 gen-delims
+    "!$&'()*+,;=" +  # RFC 3986 sub-delims
+    "%"  # Percent-encoding marker
+)
+
 def _parse_hosts_and_networks(entries, setting_name):
     hosts = set()
     networks = []
@@ -41,14 +56,57 @@ def _match_entries(target_hostname, resolved_ips, hosts, networks):
     return False
 
 
+def _validate_raw_url_characters(webhook_url):
+    # There's no need to be user-friendly in accepting malformed URLs in code that is security-sensitive; we just want
+    # to be strict and reject anything that isn't a valid URL character. People will be able to set up their webhooks
+    # without the "friendlyness" of a browser's URL bar.
+    for char in webhook_url:
+        if char in _URL_ALLOWED_CHARACTERS:
+            continue
+        raise ValueError("Webhook URL must contain only ASCII URL characters.")
+
+def _prepare_webhook_url(webhook_url):
+    try:
+        return requests.Request("POST", webhook_url).prepare().url
+    except RequestException as e:
+        raise ValueError("Webhook URL is malformed.") from e
+
+
 def validate_webhook_url(webhook_url):
-    parsed = urlparse(webhook_url)
+    _validate_raw_url_characters(webhook_url)
+
+    # Both requests and urllib3 make some attempts to normalize malformed URLs. We must apply the
+    # same normalization before our own parsing and checks, to avoid discrepancies between what we
+    # check and what then actually happens.
+    prepared_webhook_url = _prepare_webhook_url(webhook_url)
+
+    try:
+        # NOTE: requests uses urllib3's URL parsing logic, so we must use the same to ensure consistency; do not change
+        # this import to something else, doing so may have security implications if the URL parsing logic differs in how
+        # it normalizes or rejects certain inputs.
+        parsed = parse_url_from_urllib3(prepared_webhook_url)
+    except LocationParseError as e:
+        raise ValueError("Webhook URL is malformed.") from e
+
     if parsed.scheme not in {"http", "https"}:
         raise ValueError("Webhook URL must use http:// or https://.")
     if parsed.hostname is None:
         raise ValueError("Webhook URL must include a hostname.")
 
     hostname = parsed.hostname.lower()
+    if hostname.startswith("[") and hostname.endswith("]"):
+        # In URL authority syntax, brackets are only used for IP literals. urllib3 keeps those brackets in `hostname`,
+        # but the rest of this function expects the plain host value so we must strip them back out.
+        inner_hostname = hostname[1:-1]
+        try:
+            # Rather than "just strip brackets if present", we verify that the inner value is actually a valid IP
+            # address; we don't want to "just generally strip stuff" in security-sentitive code.
+            ipaddress.ip_address(inner_hostname)
+        except ValueError:
+            pass
+        else:
+            hostname = inner_hostname
+
     settings = get_settings()
     mode = settings.ALERTS_WEBHOOK_OUTBOUND_MODE
 
@@ -63,9 +121,9 @@ def validate_webhook_url(webhook_url):
 
     # Resolve on every send to defend against DNS changes after configuration time.
     try:
-        resolved_ips = {ipaddress.ip_address(ip) for ip in _resolve_ip_addresses(parsed.hostname, port)}
+        resolved_ips = {ipaddress.ip_address(ip) for ip in _resolve_ip_addresses(hostname, port)}
     except OSError as e:
-        raise ValueError(f"Webhook hostname could not be resolved: {parsed.hostname}") from e
+        raise ValueError(f"Webhook hostname could not be resolved: {hostname}") from e
 
     allow_match = _match_entries(hostname, resolved_ips, allow_hosts, allow_networks)
     deny_match = _match_entries(hostname, resolved_ips, deny_hosts, deny_networks)

@@ -527,6 +527,27 @@ def test_allows_public_ip_target_in_open_mode(self, mock_resolve):
         mock_resolve.return_value = {"93.184.216.34"}
         validate_webhook_url("https://hooks.example.com/webhook")
 
+    @patch("alerts.service_backends.webhook_security._validate_raw_url_characters")
+    def test_rejects_backslash_exploit_that_tries_to_bypass_allowlist(self, mock_validate_raw_characters):
+        # We can't think of an exploit that would exploit discrepancies between requests' parser and other parsers but
+        # not already be caught by our raw character validation. Hence we need to turn off raw character validation in
+        # the test to test against the case of mismatch-exploiting that we do know to exist.
+        mock_validate_raw_characters.return_value = None
+
+        with override_bugsink_settings(
+                ALERTS_WEBHOOK_OUTBOUND_MODE="allowlist_only",
+                ALERTS_WEBHOOK_ALLOW_LIST=["whitelist.com"]):
+            with self.assertRaisesRegex(ValueError, "not allowlisted"):
+                validate_webhook_url(r"http://127.0.0.1:6666\@whitelist.com")
+
+    def test_rejects_raw_unicode_character(self):
+        with self.assertRaisesRegex(ValueError, "must contain only ASCII URL characters"):
+            validate_webhook_url("https://hooks.example.com/caf\xe9")
+
+    def test_rejects_raw_backslash_character(self):
+        with self.assertRaisesRegex(ValueError, "must contain only ASCII URL characters"):
+            validate_webhook_url(r"https://hooks.example.com\path")
+
     @patch("alerts.service_backends.webhook_security._resolve_ip_addresses")
     def test_denied_when_allow_and_deny_both_match(self, mock_resolve):
         mock_resolve.return_value = {"93.184.216.34"}

@@ -1,5 +1,30 @@
 # Changes
 
+## 2.1.3 (2 May 2026)
+
+### Security
+
+Fix: harden webhook URL validation parsing and reject non-RFC characters.
+
+In some malformed URLs, Python’s standard URL parser (urllib) and the HTTP
+client stack (requests / urllib3) do not agree on which host is actually being
+targeted. That could allow a webhook URL to pass Bugsink’s outbound-host checks
+while the actual HTTP request is sent somewhere else. See:
+
+https://github.com/bugsink/bugsink/security/advisories/GHSA-fp53-qcf8-2xx2
+
+### Smaller fixes
+
+* Add issue-level markdown, see #334.
+* Fix installation quota counting across projects, see #359.
+* When vacuuming files, don't load them in memory, and allow long-running totals queries, see #363, #373 and #372.
+* Refuse to send email as something@bugsink.com for self-hosters, see 3ff3a6fbeb6d.
+* Fix `MultipleObjectsReturned` when user has unaccepted project memberships, see 653be6968f6e.
+* Cleanup lingering files for `MAX_EVENT_SIZE` overshoots, see #370.
+* Fix some `.get(context, {})` usages and an exception-path double-exception, see #369.
+* Upgrade `gunicorn` requirement from `==25.1.*` to `==25.3.*`, see 2d5e0071cf66.
+* Upgrade monofy, see #367.
+
 ## 2.1.2 (11 April 2026)
 
 * Add stored file count and byte caps, see #355