Function TestSSRFPrevention

coderd/webpush/webpush_test.go:571–617

TestSSRFPrevention verifies that the default SSRF-safe HTTP client blocks webpush delivery to loopback (and other non-public) addresses. This reproduces the attack vector from the original SSRF PoC: an authenticated user supplies a localhost endpoint in their webpush subscription, and the server mus

(t *testing.T)

// user supplies a localhost endpoint in their webpush subscription, and the
// server must refuse to connect.
func TestSSRFPrevention(t *testing.T) {
	t.Parallel()

	ctx := testutil.Context(t, testutil.WaitShort)

	// Start a server that records whether it received a request.
	var received atomic.Bool
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		received.Store(true)
		w.WriteHeader(http.StatusCreated)
	}))
	defer server.Close()

	// Create a dispatcher via New() WITHOUT WithHTTPClient so it
	// uses the default SSRF-safe client that blocks loopback.
	db, _ := dbtestutil.NewDB(t)
	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
	manager, err := webpush.New(ctx, &logger, db, "http://example.com")
	require.NoError(t, err)

	// Test() calls webpushSend directly with the supplied endpoint.
	err = manager.Test(ctx, codersdk.WebpushSubscription{
		Endpoint:  server.URL,
		AuthKey:   validEndpointAuthKey,
		P256DHKey: validEndpointP256dhKey,
	})
	require.Error(t, err, "SSRF-safe client should reject Test() to loopback address")
	assert.False(t, received.Load(), "Test() request should not reach the localhost server")

	// Dispatch() goes through the subscription cache → webpushSend path.
	user := dbgen.User(t, db, database.User{})
	_, err = db.InsertWebpushSubscription(ctx, database.InsertWebpushSubscriptionParams{
		CreatedAt:         dbtime.Now(),
		UserID:            user.ID,
		Endpoint:          server.URL,
		EndpointAuthKey:   validEndpointAuthKey,
		EndpointP256dhKey: validEndpointP256dhKey,
	})
	require.NoError(t, err)

	err = manager.Dispatch(ctx, user.ID, codersdk.WebpushMessage{
		Title: "SSRF test",
		Body:  "This should not arrive.",
	})
	require.Error(t, err, "SSRF-safe client should reject Dispatch() to loopback address")
	assert.False(t, received.Load(), "Dispatch() request should not reach the localhost server")
}