Papra HTTP redirect bypass can lead to SSRF via webhook delivery system

@@ -81,6 +81,7 @@
     "resend": "^4.6.0",
     "stripe": "^17.7.0",
     "tsx": "catalog:",
+    "undici": "^8.2.0",
     "valibot": "catalog:"
   },
   "devDependencies": {

@@ -0,0 +1,61 @@
+import type { WebhookHttpClient } from '@papra/webhooks';
+import type { BlockList } from 'node:net';
+import { ofetch } from 'ofetch';
+import { Agent } from 'undici';
+import { ssrfBlockList } from '../shared/ssrf/ssrf.models';
+import { getUrlHostname } from '../shared/urls/urls.models';
+
+export function createWebhookHttpClient({
+  isSsrfProtectionEnabled,
+  allowedHostnames,
+  blockList = ssrfBlockList,
+}: {
+  isSsrfProtectionEnabled: boolean;
+  allowedHostnames: Set<string>;
+  blockList?: BlockList;
+}): WebhookHttpClient {
+  const ssrfSafeAgent = isSsrfProtectionEnabled
+    ? new Agent({ connect: { blockList } })
+    : undefined;
+
+  return async ({ url, ...options }) => {
+    const hostname = getUrlHostname(url);
+    const isAllowlisted = hostname !== null && allowedHostnames.has(hostname);
+    const dispatcher = isAllowlisted ? undefined : ssrfSafeAgent;
+
+    const response = await ofetch.raw<unknown>(url, {
+      ...options,
+      // @ts-expect-error ofetch resolves undici types from the root install (pulled in by some transitive dep) which may differ from the server's direct undici dep. Runtime is compatible.
+      dispatcher,
+      ignoreResponseError: true,
+      redirect: 'manual', // don't follow redirects, just return the 3xx response
+    });
+
+    return {
+      responseStatus: response.status,
+      responseData: response._data,
+    };
+  };
+}
+
+export function isSsrfBlockedError(error: unknown): boolean {
+  if (!Error.isError(error)) {
+    return false;
+  }
+
+  if ('code' in error && error.code === 'ERR_IP_BLOCKED') {
+    return true;
+  }
+
+  // check if error is an AggregateError containing ssrf blocked errors
+  if (error instanceof AggregateError) {
+    return error.errors.some(isSsrfBlockedError);
+  }
+
+  // check if error has a cause that is an ssrf blocked error
+  if ('cause' in error) {
+    return isSsrfBlockedError(error.cause);
+  }
+
+  return false;
+}

@@ -1,6 +1,7 @@
 import type { WebhookRepository } from './webhooks.repository';
 import type { WebhooksConfig } from './webhooks.types';
 import { injectArguments } from '@corentinth/chisels';
+import { createWebhookHttpClient } from './webhooks.http-client';
 import { deferTriggerWebhooks, triggerWebhooks } from './webhooks.usecases';
 
 export type WebhookTriggerServices = ReturnType<typeof createWebhookTriggerServices>;
@@ -12,11 +13,16 @@ export function createWebhookTriggerServices({
   webhooksConfig: WebhooksConfig;
   webhookRepository: WebhookRepository;
 }) {
+  const httpClient = createWebhookHttpClient({
+    isSsrfProtectionEnabled: webhooksConfig.isSsrfProtectionEnabled,
+    allowedHostnames: webhooksConfig.webhookUrlAllowedHostnames,
+  });
+
   return injectArguments({
     triggerWebhooks,
     deferTriggerWebhooks,
   }, {
-    webhooksConfig,
     webhookRepository,
+    httpClient,
   });
 }

@@ -5,7 +5,7 @@ import { ORGANIZATION_ROLES } from '../organizations/organizations.constants';
 import { createTestLogger } from '../shared/logger/logger.test-utils';
 import { omit } from '../shared/objects';
 import { createWebhookRepository } from './webhooks.repository';
-import { webhookEventsTable, webhooksTable } from './webhooks.tables';
+import { webhookDeliveriesTable, webhookEventsTable, webhooksTable } from './webhooks.tables';
 import { createWebhook, triggerWebhooks, updateWebhook } from './webhooks.usecases';
 
 describe('webhook usecases', () => {
@@ -164,7 +164,7 @@ describe('webhook usecases', () => {
   });
 
   describe('triggerWebhooks', () => {
-    test('when SSRF protection is enabled, webhooks with unsafe URLs are filtered out and others still receive the event', async () => {
+    test('when one webhook delivery fails (e.g. blocked by SSRF protection at connect time), sibling webhooks still complete', async () => {
       const { db } = await createInMemoryDatabase({
         organizations: [
           { id: 'org_1', name: 'Organization 1' },
@@ -181,7 +181,7 @@ describe('webhook usecases', () => {
 
       const webhookRepository = createWebhookRepository({ db });
       const { logger } = createTestLogger();
-      const triggerWebhookServiceArgs: unknown[] = [];
+      const httpClientArgs: { url: string }[] = [];
 
       await triggerWebhooks({
         webhookRepository,
@@ -195,18 +195,28 @@ describe('webhook usecases', () => {
           updatedAt: new Date('2025-01-01'),
         }],
         logger,
-        triggerWebhookService: async (args) => {
-          triggerWebhookServiceArgs.push(args);
-          return { responseData: {}, responseStatus: 200, requestPayload: '{}' };
-        },
-        webhooksConfig: {
-          isSsrfProtectionEnabled: true,
-          webhookUrlAllowedHostnames: new Set<string>(),
+        httpClient: async (args) => {
+          httpClientArgs.push(args);
+
+          if (args.url.includes('192.168')) {
+            const error = new Error('IP 192.168.1.1 is blocked by net.BlockList') as Error & { code?: string };
+            error.code = 'ERR_IP_BLOCKED';
+            throw error;
+          }
+
+          return { responseData: {}, responseStatus: 200 };
         },
       });
 
-      expect(triggerWebhookServiceArgs).to.have.lengthOf(1);
-      expect((triggerWebhookServiceArgs[0] as { webhookUrl: string }).webhookUrl).to.eql('https://example.com/webhook');
+      expect(httpClientArgs.map(a => a.url)).to.eql([
+        'https://192.168.1.1/webhook',
+        'https://example.com/webhook',
+      ]);
+
+      const deliveries = await db.select().from(webhookDeliveriesTable);
+
+      expect(deliveries.length).to.eq(1);
+      expect(deliveries[0]).to.include({ responseStatus: 200 });
     });
 
     test('when an organization has webhooks enabled for an event, the configured urls are called with the event payload', async () => {
@@ -238,7 +248,7 @@ describe('webhook usecases', () => {
 
       const webhookRepository = createWebhookRepository({ db });
       const { logger } = createTestLogger();
-      const triggerWebhookServiceArgs: unknown[] = [];
+      const httpClientArgs: { url: string; body: string; headers: Record<string, string> }[] = [];
 
       const eventPayload = {
         documentId: 'doc_1',
@@ -255,39 +265,32 @@ describe('webhook usecases', () => {
         payloads: [eventPayload],
         logger,
         now: new Date('2025-05-04'),
-        triggerWebhookService: async (args) => {
-          triggerWebhookServiceArgs.push(args);
-
-          const { event, payload } = args;
-
-          return {
-            responseData: {},
-            responseStatus: 200,
-            requestPayload: JSON.stringify({ event, payload }),
-          };
-        },
-        webhooksConfig: {
-          isSsrfProtectionEnabled: false,
-          webhookUrlAllowedHostnames: new Set<string>(),
+        httpClient: async (args) => {
+          httpClientArgs.push(args);
+          return { responseData: {}, responseStatus: 200 };
         },
       });
 
-      expect(triggerWebhookServiceArgs).to.eql([
-        {
-          webhookUrl: 'https://example.com/webhook1',
-          webhookSecret: null,
-          now: new Date('2025-05-04'),
-          event: 'document:created',
-          payload: eventPayload,
-        },
-        {
-          webhookUrl: 'https://example.com/webhook3',
-          webhookSecret: 'secret3',
-          now: new Date('2025-05-04'),
-          event: 'document:created',
-          payload: eventPayload,
-        },
+      expect(httpClientArgs.map(a => a.url)).to.eql([
+        'https://example.com/webhook1',
+        'https://example.com/webhook3',
       ]);
+
+      for (const args of httpClientArgs) {
+        expect(JSON.parse(args.body)).to.eql({
+          type: 'document:created',
+          timestamp: '2025-05-04T00:00:00.000Z',
+          data: {
+            ...eventPayload,
+            createdAt: eventPayload.createdAt.toISOString(),
+            updatedAt: eventPayload.updatedAt.toISOString(),
+          },
+        });
+      }
+
+      // Only the webhook with a configured secret should produce a signature header
+      expect(httpClientArgs[0]?.headers['webhook-signature']).toBeUndefined();
+      expect(typeof httpClientArgs[1]?.headers['webhook-signature']).to.eq('string');
     });
   });
 });

@@ -1,14 +1,15 @@
-import type { EventName, WebhookPayloads } from '@papra/webhooks';
+import type { EventName, WebhookHttpClient, WebhookPayloads } from '@papra/webhooks';
 import type { Logger } from '../shared/logger/logger';
 import type { WebhookRepository } from './webhooks.repository';
 import type { Webhook, WebhookMultiplePayloads, WebhooksConfig } from './webhooks.types';
-import { triggerWebhook as triggerWebhookServiceImpl } from '@papra/webhooks';
+import { triggerWebhook as triggerWebhookService } from '@papra/webhooks';
 import pLimit from 'p-limit';
 import { createDeferable } from '../shared/async/defer';
 import { createLogger } from '../shared/logger/logger';
-import { createCachedIsUrlSsrfSafeFunction, isUrlSsrfSafe } from '../shared/ssrf/ssrf.services';
+import { isUrlSsrfSafe } from '../shared/ssrf/ssrf.services';
 import { WEBHOOK_URL_ALLOWED_HOSTNAMES_ENV_VAR } from './webhooks.constants';
 import { createSsrfUnsafeUrlError, createWebhookNotFoundError } from './webhooks.errors';
+import { isSsrfBlockedError } from './webhooks.http-client';
 
 export async function createWebhook({
   name,
@@ -103,16 +104,14 @@ export async function triggerWebhooks({
   organizationId,
   now = new Date(),
   logger = createLogger({ namespace: 'webhook' }),
-  triggerWebhookService = triggerWebhookServiceImpl,
-  webhooksConfig,
+  httpClient,
   ...multiplePayloadsData
 }: {
   webhookRepository: WebhookRepository;
   organizationId: string;
   now?: Date;
   logger?: Logger;
-  triggerWebhookService?: typeof triggerWebhookServiceImpl;
-  webhooksConfig: WebhooksConfig;
+  httpClient: WebhookHttpClient;
 } & WebhookMultiplePayloads) {
   const { event } = multiplePayloadsData;
   const singlePayloads = splitMultiplePayloads(multiplePayloadsData);
@@ -121,59 +120,19 @@ export async function triggerWebhooks({
 
   logger.info({ webhooksCount: webhooks.length, organizationId, event, payloadsCount: singlePayloads.length }, 'Triggering webhooks');
 
-  const safeWebhooks = await filterOutSsrfUnsafeWebhooks({ webhooks, webhooksConfig, logger });
-
   const limit = pLimit(10);
 
   await Promise.all(
-    safeWebhooks.flatMap(webhook =>
+    webhooks.flatMap(webhook =>
       singlePayloads.map(async webhookData =>
         limit(async () =>
-          triggerWebhook({ webhook, webhookRepository, now, ...webhookData, logger, triggerWebhookService }),
+          triggerWebhook({ webhook, webhookRepository, now, ...webhookData, logger, httpClient }),
         ),
       ),
     ),
   );
 }
 
-async function filterOutSsrfUnsafeWebhooks({
-  webhooks,
-  webhooksConfig,
-  logger,
-}: {
-  webhooks: Webhook[];
-  webhooksConfig: WebhooksConfig;
-  logger: Logger;
-}): Promise<Webhook[]> {
-  if (!webhooksConfig.isSsrfProtectionEnabled) {
-    return webhooks;
-  }
-
-  const limit = pLimit(10);
-
-  // Caching is done at the function level to limit the TOCTOU window while still avoiding redundant checks for duplicate URLs across webhooks
-  const isUrlSsrfSafeCached = createCachedIsUrlSsrfSafeFunction({
-    allowedHostnames: webhooksConfig.webhookUrlAllowedHostnames,
-    logger,
-  });
-
-  const checked = await Promise.all(
-    webhooks.map(async webhook =>
-      limit(async () => {
-        const isSafe = await isUrlSsrfSafeCached({ url: webhook.url });
-
-        if (!isSafe) {
-          reportNonSsrfSafeWebhookUrl({ url: webhook.url, logger });
-        }
-
-        return { webhook, isSafe };
-      }),
-    ),
-  );
-
-  return checked.filter(({ isSafe }) => isSafe).map(({ webhook }) => webhook);
-}
-
 function splitMultiplePayloads(data: WebhookMultiplePayloads): WebhookPayloads[] {
   return data.payloads.map(payload => ({ event: data.event, payload })) as WebhookPayloads[];
 }
@@ -185,36 +144,47 @@ async function triggerWebhook({
   webhookRepository,
   now = new Date(),
   logger = createLogger({ namespace: 'webhook' }),
-  triggerWebhookService = triggerWebhookServiceImpl,
+  httpClient,
   ...webhookData
 }: {
   webhook: Webhook;
   webhookRepository: WebhookRepository;
+  httpClient: WebhookHttpClient;
   now?: Date;
   logger?: Logger;
-  triggerWebhookService?: typeof triggerWebhookServiceImpl;
 } & WebhookPayloads) {
   const { url, secret, organizationId } = webhook;
   const { event } = webhookData;
 
   logger.info({ webhookId: webhook.id, event, organizationId }, 'Triggering webhook');
 
-  const { responseData, responseStatus, requestPayload } = await triggerWebhookService({
-    webhookUrl: url,
-    webhookSecret: secret,
-    now,
-    ...webhookData,
-  });
+  try {
+    const { responseData, responseStatus, requestPayload } = await triggerWebhookService({
+      webhookUrl: url,
+      webhookSecret: secret,
+      now,
+      httpClient,
+      ...webhookData,
+    });
 
-  logger.info({ webhookId: webhook.id, event, responseStatus, organizationId }, 'Webhook triggered');
+    logger.info({ webhookId: webhook.id, event, responseStatus, organizationId }, 'Webhook triggered');
 
-  await webhookRepository.saveWebhookDelivery({
-    webhookId: webhook.id,
-    eventName: event,
-    requestPayload: JSON.stringify(requestPayload),
-    responsePayload: JSON.stringify(responseData),
-    responseStatus,
-  });
+    await webhookRepository.saveWebhookDelivery({
+      webhookId: webhook.id,
+      eventName: event,
+      requestPayload: JSON.stringify(requestPayload),
+      responsePayload: JSON.stringify(responseData),
+      responseStatus,
+    });
+  } catch (error) {
+    const blockedBySsrf = isSsrfBlockedError(error);
+
+    if (blockedBySsrf) {
+      reportNonSsrfSafeWebhookUrl({ url, logger });
+    } else {
+      logger.error({ webhookId: webhook.id, event, organizationId, error }, 'Webhook delivery failed');
+    }
+  }
 }
 
 function reportNonSsrfSafeWebhookUrl({ url, logger }: { url: string; logger: Logger }) {

@@ -0,0 +1,5 @@
+---
+"@papra/app": patch
+---
+
+Webhooks no longer follow http redirects (3xx responses) when sending requests.

@@ -0,0 +1,5 @@
+---
+"@papra/app": patch
+---
+
+Webhooks ssrf validation is now enforced when sending webhook requests, preventing potential TOCTOU dns rebinding attacks (the exploitation window was very small and only theoretical though).

@@ -0,0 +1,5 @@
+---
+"@papra/webhooks": patch
+---
+
+Export the http client type.

@@ -1,4 +1,4 @@
 export { createWebhooksHandler } from './handler/handler.services';
 export { EVENT_NAMES, type EventName } from './webhooks.constants';
-export { triggerWebhook } from './webhooks.services';
+export { triggerWebhook, type WebhookHttpClient } from './webhooks.services';
 export type { StandardWebhookEventPayload, WebhookEvents, WebhookPayload, WebhookPayloads } from './webhooks.types';

@@ -4,15 +4,17 @@ import { ofetch } from 'ofetch';
 import { signBody } from './signature';
 import { serializeBody } from './webhooks.models';
 
-export async function webhookHttpClient({
-  url,
-  ...options
-}: {
+export type WebhookHttpClient = (args: {
   url: string;
   method: string;
   body: string;
   headers: Record<string, string>;
-}) {
+}) => Promise<{
+  responseStatus: number;
+  responseData: unknown;
+}>;
+
+export const webhookHttpClient: WebhookHttpClient = async ({ url, ...options }) => {
   const response = await ofetch.raw<unknown>(url, {
     ...options,
     ignoreResponseError: true,
@@ -22,7 +24,7 @@ export async function webhookHttpClient({
     responseStatus: response.status,
     responseData: response._data,
   };
-}
+};
 
 export async function triggerWebhook<T extends WebhookPayloads>({
   webhookUrl,
@@ -35,7 +37,7 @@ export async function triggerWebhook<T extends WebhookPayloads>({
 }: {
   webhookUrl: string;
   webhookSecret?: string | null;
-  httpClient?: typeof webhookHttpClient;
+  httpClient?: WebhookHttpClient;
   payload: T['payload'];
   now?: Date;
   event: T['event'];