Fix/ssrf alerts target#1665
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughThis PR adds tenant-aware outbound policy storage and validation for alert targets, exposes admin endpoints to read and update the policy, and applies the policy during target create/update and alert delivery. It also adds supporting storage paths, metastore APIs, and routing. ChangesOutbound Alert Policy System
Estimated code review effort: 4 (Complex) | ~50 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
Cargo.toml (1)
84-91: 💤 Low value
ipnetaddition not reflected in summary; otherwise dependency changes look correct.The
netfeature ontokio("^1.43") is valid and required for DNS resolution/socket operations in the policy engine. However, line 91 also addsipnet = "2"(needed for CIDR parsing in the allow/deny policy), which contradicts the summary's claim that no other dependencies were altered.Note that
ipnetis placed under the "Async and Runtime" section though it's a networking/CIDR utility — consider moving it nearerurl/networking deps for clarity, but this is purely cosmetic.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Cargo.toml` around lines 84 - 91, Update the PR summary to explicitly mention the new ipnet = "2" dependency (used for CIDR parsing in allow/deny policy) in addition to the tokio feature change; in the Cargo.toml diff, ensure the ipnet addition is clearly associated with networking/url deps rather than the "Async and Runtime" block by moving the ipnet = "2" line next to other networking dependencies (the tokio features block and url dependency) so reviewers can easily see it's a networking/CIDR utility; keep the existing tokio feature changes (sync, macros, fs, rt-multi-thread, net) unchanged.src/alerts/outbound_http_policy.rs (1)
167-169: 💤 Low valueConsider propagating client build errors instead of panicking.
While the
ClientBuilderconfiguration is deterministic and unlikely to fail in practice, using.expect()in production code paths is less defensive than propagating the error. If future changes introduce fallible configuration (e.g., loading certificates), this would need updating.🛡️ Suggested fix
Add a new error variant and propagate:
+ #[error("failed to build HTTP client: {0}")] + ClientBuildFailed(String),let client = builder .build() - .expect("alert target HTTP client can be constructed"); + .map_err(|e| OutboundPolicyError::ClientBuildFailed(e.to_string()))?;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/alerts/outbound_http_policy.rs` around lines 167 - 169, Replace the panic-causing .expect("alert target HTTP client can be constructed") on builder.build() with proper error propagation: add a new error variant (e.g., OutboundHttpClientBuildError or ClientBuildError) to the module's error enum, change the containing function's return type to Result<..., ErrorType>, and replace builder.build().expect(...) with builder.build().map_err(|e| ErrorType::OutboundHttpClientBuildError(e.into()))? (or equivalent) so the client construction failure is returned to callers; update any call sites and tests to handle the propagated Result accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/alerts/outbound_http_policy.rs`:
- Around line 306-323: In denied_ipv6, add explicit checks to reject IPv6
tunneling prefixes 6to4 (2002::/16) and Teredo (2001::/32) before falling back
to mapped-IPv4 handling: inspect ip.segments()[0] and return true when it equals
0x2002 (6to4) or equals 0x2001 (Teredo /32), then continue with the existing
mapped-IPv4 call to denied_ipv4 and other checks; this ensures embedded IPv4
addresses in those tunneling ranges cannot bypass the private-IP blocking.
---
Nitpick comments:
In `@Cargo.toml`:
- Around line 84-91: Update the PR summary to explicitly mention the new ipnet =
"2" dependency (used for CIDR parsing in allow/deny policy) in addition to the
tokio feature change; in the Cargo.toml diff, ensure the ipnet addition is
clearly associated with networking/url deps rather than the "Async and Runtime"
block by moving the ipnet = "2" line next to other networking dependencies (the
tokio features block and url dependency) so reviewers can easily see it's a
networking/CIDR utility; keep the existing tokio feature changes (sync, macros,
fs, rt-multi-thread, net) unchanged.
In `@src/alerts/outbound_http_policy.rs`:
- Around line 167-169: Replace the panic-causing .expect("alert target HTTP
client can be constructed") on builder.build() with proper error propagation:
add a new error variant (e.g., OutboundHttpClientBuildError or ClientBuildError)
to the module's error enum, change the containing function's return type to
Result<..., ErrorType>, and replace builder.build().expect(...) with
builder.build().map_err(|e| ErrorType::OutboundHttpClientBuildError(e.into()))?
(or equivalent) so the client construction failure is returned to callers;
update any call sites and tests to handle the propagated Result accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 307e02c4-1433-45cc-90f4-a9ee10f8c67c
⛔ Files ignored due to path filters (1)
Cargo.lockis excluded by!**/*.lock
📒 Files selected for processing (9)
Cargo.tomlsrc/alerts/mod.rssrc/alerts/outbound_http_policy.rssrc/alerts/target.rssrc/handlers/http/alert_target_policy.rssrc/handlers/http/mod.rssrc/handlers/http/modal/query_server.rssrc/handlers/http/modal/server.rssrc/handlers/http/targets.rs
ygndotgg
force-pushed
the
fix/ssrf-alerts-target
branch
from
fa45266 to
b8f9628
Compare
parmesant
force-pushed
the
fix/ssrf-alerts-target
branch
from
b8f9628 to
a5327c8
Compare
parmesant
force-pushed
the
fix/ssrf-alerts-target
branch
from
a5327c8 to
a955914
Compare
- replace the single global policy manager with per-tenant policy state - persist outbound HTTP policy through metastore and reload it on startup - reject policies with overlapping allow/deny domain or CIDR entries - follow the existing tenant-keyed design used elsewhere in the codebase
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
src/alerts/target.rs (1)
662-665: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winAvoid logging the full AlertManager endpoint.
self.endpointcan include userinfo, query tokens, or sensitive path data. Log only a sanitized host/scheme when credentials are blocked.Proposed fix
error!( - "Alertmanager credentials blocked by outbound policy for destination:{}", - self.endpoint + "Alertmanager credentials blocked by outbound policy for destination_host:{}", + self.endpoint.host_str().unwrap_or("<missing-host>") );🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/alerts/target.rs` around lines 662 - 665, The blocked-credentials log in AlertmanagerTarget::send is exposing the full endpoint via self.endpoint, which may include sensitive userinfo or tokens. Update the error! call to log only a sanitized Alertmanager destination, keeping just the scheme and host from AlertmanagerTarget::endpoint and excluding credentials, query strings, and sensitive path data. Use the existing endpoint handling in src/alerts/target.rs to derive the sanitized value before logging.src/storage/localfs.rs (1)
504-512: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDon't filter out
DEFAULT_TENANThere.DEFAULT_TENANTis a literal string constant ("DEFAULT_TENANT"), and stream-name validation does not reserve it, so a stream with that name would disappear from bothlist_streamsandlist_old_streams. If the goal is to skip a stray root folder, narrow the check to the tenant directory layout instead of matching the stream name exactly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/storage/localfs.rs` around lines 504 - 512, The list_streams filtering currently excludes DEFAULT_TENANT by name, which can hide a valid stream. Update list_streams in localfs.rs so the ignore_dir logic no longer matches the DEFAULT_TENANT constant directly; instead, only skip the tenant root folder based on the directory layout used by the storage hierarchy. Keep the rest of the exclusion list unchanged and ensure list_old_streams follows the same rule if it shares the same filtering logic.Source: Learnings
🧹 Nitpick comments (1)
src/handlers/http/targets.rs (1)
34-37: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winUse
get_tenant_id_from_requesthere. This handler only needs the normalized tenant header; re-resolving tenant from auth adds an unnecessary RBAC dependency and maps those failures toCustomError.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/handlers/http/targets.rs` around lines 34 - 37, The tenant lookup in tenant_from_request is using get_user_and_tenant_from_request, which pulls auth-derived tenant data and introduces an unnecessary RBAC dependency. Update tenant_from_request to use get_tenant_id_from_request instead, keep the same Result<Option<String>, AlertError> shape, and remove the CustomError mapping path so this handler only reads the normalized tenant header.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/alerts/outbound_http_policy.rs`:
- Around line 37-59: The active_policy() lookup in outbound_http_policy.rs only
returns AlertTargetPolicyConfig::default() for DEFAULT_TENANT, causing missing
tenant entries to fail with PolicyNotFound. Update active_policy() so a missing
policy for any tenant falls back to AlertTargetPolicyConfig::default() instead
of erroring, while keeping the existing read-from-ALERT_TARGET_POLICY behavior
and using OutboundPolicyError::PolicyNotFound only for truly invalid cases.
In `@src/handlers/http/modal/mod.rs`:
- Around line 237-240: The outbound policy bootstrap in load_on_init uses ?
after outbound_http_policy::load_all_policies, which makes a single bad tenant
policy abort startup unlike the other loaders. Update this block to match the
existing pattern used by correlations, filters, dashboards, alerts, and targets:
call outbound_http_policy::load_all_policies, log any error with error!
including context, and continue without returning early so one corrupt policy
does not take down the whole node.
In `@src/metastore/metastores/object_store_metastore.rs`:
- Around line 1258-1270: `get_outbound_policy` currently propagates a
missing-object storage error instead of treating it as “no policy configured,”
which makes single-tenant policy loads fail unexpectedly. Update
`ObjectStoreMetastore::get_outbound_policy` to mirror the missing-file handling
used in `get_outbound_policies` by detecting the optional-missing case from
`self.storage.get_object` and returning the appropriate default/absence behavior
instead of `?`. Keep the existing path/tenant logic intact, and make sure
callers like `load_policy_for_tenant` can resolve cleanly for tenants without a
stored policy.
---
Outside diff comments:
In `@src/alerts/target.rs`:
- Around line 662-665: The blocked-credentials log in AlertmanagerTarget::send
is exposing the full endpoint via self.endpoint, which may include sensitive
userinfo or tokens. Update the error! call to log only a sanitized Alertmanager
destination, keeping just the scheme and host from AlertmanagerTarget::endpoint
and excluding credentials, query strings, and sensitive path data. Use the
existing endpoint handling in src/alerts/target.rs to derive the sanitized value
before logging.
In `@src/storage/localfs.rs`:
- Around line 504-512: The list_streams filtering currently excludes
DEFAULT_TENANT by name, which can hide a valid stream. Update list_streams in
localfs.rs so the ignore_dir logic no longer matches the DEFAULT_TENANT constant
directly; instead, only skip the tenant root folder based on the directory
layout used by the storage hierarchy. Keep the rest of the exclusion list
unchanged and ensure list_old_streams follows the same rule if it shares the
same filtering logic.
---
Nitpick comments:
In `@src/handlers/http/targets.rs`:
- Around line 34-37: The tenant lookup in tenant_from_request is using
get_user_and_tenant_from_request, which pulls auth-derived tenant data and
introduces an unnecessary RBAC dependency. Update tenant_from_request to use
get_tenant_id_from_request instead, keep the same Result<Option<String>,
AlertError> shape, and remove the CustomError mapping path so this handler only
reads the normalized tenant header.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 688f6ea9-3f32-4f7c-8748-cd98cb9a3b6e
📒 Files selected for processing (10)
src/alerts/alert_traits.rssrc/alerts/outbound_http_policy.rssrc/alerts/target.rssrc/handlers/http/alert_target_policy.rssrc/handlers/http/modal/mod.rssrc/handlers/http/targets.rssrc/metastore/metastore_traits.rssrc/metastore/metastores/object_store_metastore.rssrc/storage/localfs.rssrc/storage/object_storage.rs
| pub static ALERT_TARGET_POLICY: Lazy<RwLock<HashMap<String, AlertTargetPolicyConfig>>> = | ||
| Lazy::new(|| RwLock::new(HashMap::new())); | ||
|
|
||
| // Read one policy snapshot per validation | ||
| pub async fn active_policy( | ||
| tenant_id: &Option<String>, | ||
| ) -> Result<AlertTargetPolicyConfig, OutboundPolicyError> { | ||
| let tenant = tenant_id | ||
| .as_deref() | ||
| .unwrap_or(crate::parseable::DEFAULT_TENANT); | ||
| let guard = ALERT_TARGET_POLICY.read().await; | ||
| guard | ||
| .get(tenant) | ||
| .cloned() | ||
| .or_else(|| { | ||
| if tenant == crate::parseable::DEFAULT_TENANT { | ||
| Some(AlertTargetPolicyConfig::default()) | ||
| } else { | ||
| None | ||
| } | ||
| }) | ||
| .ok_or_else(|| OutboundPolicyError::PolicyNotFound(tenant.to_string())) | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Look for any tenant-provisioning code that seeds outbound policy defaults
rg -n 'replace_policy|put_outbound_policy|load_policy_for_tenant' --type=rust -C3Repository: parseablehq/parseable
Length of output: 159
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "ALERT_TARGET_POLICY|PolicyNotFound|active_policy|load_all_policies|load_policy_for_tenant|outbound policy|alert target policy|DEFAULT_TENANT" src -C 3Repository: parseablehq/parseable
Length of output: 50378
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n "get_outbound_policy|get_outbound_policies|put_outbound_policy|outbound_policy" src/metastore src/handlers src/tenants src -g'*.rs' -C 2 | head -n 200Repository: parseablehq/parseable
Length of output: 9306
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1190,1295p' src/metastore/metastores/object_store_metastore.rs
printf '\n---\n'
rg -n "create tenant|create_tenant|new tenant|tenant provisioning|put_outbound_policy\\(|load_all_policies\\(" src -g'*.rs' -C 2 | head -n 200Repository: parseablehq/parseable
Length of output: 6021
Default outbound policy should not fail for tenants without an entry
active_policy() only falls back to AlertTargetPolicyConfig::default() for DEFAULT_TENANT. Every other tenant missing a stored policy returns PolicyNotFound, so alert-target create/update/delivery fails until an admin manually seeds a policy. Load a default policy for missing tenant entries as well.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/alerts/outbound_http_policy.rs` around lines 37 - 59, The active_policy()
lookup in outbound_http_policy.rs only returns
AlertTargetPolicyConfig::default() for DEFAULT_TENANT, causing missing tenant
entries to fail with PolicyNotFound. Update active_policy() so a missing policy
for any tenant falls back to AlertTargetPolicyConfig::default() instead of
erroring, while keeping the existing read-from-ALERT_TARGET_POLICY behavior and
using OutboundPolicyError::PolicyNotFound only for truly invalid cases.
| outbound_http_policy::load_all_policies(PARSEABLE.metastore.as_ref()) | ||
| .await | ||
| .context("Failed to load outbound policies")?; | ||
|
|
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Outbound-policy load failure aborts startup unlike every other loader here.
All sibling loaders (correlations, filters, dashboards, alerts, targets) log failures via error!() and continue so one broken resource doesn't block startup. This new call instead uses ?, so a single tenant's invalid/corrupt stored policy (e.g. load_all_policies fails closed on the first bad tenant policy) will abort load_on_init entirely, taking down the whole node rather than just that tenant's alerting.
♻️ Suggested fix to match the existing loader pattern
- outbound_http_policy::load_all_policies(PARSEABLE.metastore.as_ref())
- .await
- .context("Failed to load outbound policies")?;
-
+ if let Err(err) = outbound_http_policy::load_all_policies(PARSEABLE.metastore.as_ref()).await {
+ error!("Failed to load outbound policies: {err}");
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| outbound_http_policy::load_all_policies(PARSEABLE.metastore.as_ref()) | |
| .await | |
| .context("Failed to load outbound policies")?; | |
| if let Err(err) = outbound_http_policy::load_all_policies(PARSEABLE.metastore.as_ref()).await { | |
| error!("Failed to load outbound policies: {err}"); | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/handlers/http/modal/mod.rs` around lines 237 - 240, The outbound policy
bootstrap in load_on_init uses ? after outbound_http_policy::load_all_policies,
which makes a single bad tenant policy abort startup unlike the other loaders.
Update this block to match the existing pattern used by correlations, filters,
dashboards, alerts, and targets: call outbound_http_policy::load_all_policies,
log any error with error! including context, and continue without returning
early so one corrupt policy does not take down the whole node.
| async fn get_outbound_policy( | ||
| &self, | ||
| tenant_id: &str, | ||
| ) -> Result<AlertTargetPolicyConfig, MetastoreError> { | ||
| let tenant = if tenant_id == DEFAULT_TENANT { | ||
| None | ||
| } else { | ||
| Some(tenant_id.to_string()) | ||
| }; | ||
| let path = outbound_http_policy_json_path(&tenant); | ||
| let bytes = self.storage.get_object(&path, &tenant).await?; | ||
| Ok(serde_json::from_slice::<AlertTargetPolicyConfig>(&bytes)?) | ||
| } |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
get_outbound_policy doesn't tolerate a missing policy file, unlike get_outbound_policies.
get_outbound_policies treats a missing policy file per-tenant as "no policy configured" (skips via is_missing_optional_dir), but get_outbound_policy propagates the raw storage error via ? for the same case. Any caller of this single-tenant accessor (e.g. load_policy_for_tenant) will hard-fail for a tenant that has never explicitly stored a policy, instead of resolving to a default. This is worth aligning with the bulk method's semantics — see related comment on active_policy in src/alerts/outbound_http_policy.rs, which similarly only falls back to a default for DEFAULT_TENANT.
🛡️ Proposed fix to fall back gracefully on missing policy
async fn get_outbound_policy(
&self,
tenant_id: &str,
) -> Result<AlertTargetPolicyConfig, MetastoreError> {
let tenant = if tenant_id == DEFAULT_TENANT {
None
} else {
Some(tenant_id.to_string())
};
let path = outbound_http_policy_json_path(&tenant);
- let bytes = self.storage.get_object(&path, &tenant).await?;
- Ok(serde_json::from_slice::<AlertTargetPolicyConfig>(&bytes)?)
+ match self.storage.get_object(&path, &tenant).await {
+ Ok(bytes) => Ok(serde_json::from_slice::<AlertTargetPolicyConfig>(&bytes)?),
+ Err(err) if is_missing_optional_dir(&err) => Ok(AlertTargetPolicyConfig::default()),
+ Err(err) => Err(MetastoreError::ObjectStorageError(err)),
+ }
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| async fn get_outbound_policy( | |
| &self, | |
| tenant_id: &str, | |
| ) -> Result<AlertTargetPolicyConfig, MetastoreError> { | |
| let tenant = if tenant_id == DEFAULT_TENANT { | |
| None | |
| } else { | |
| Some(tenant_id.to_string()) | |
| }; | |
| let path = outbound_http_policy_json_path(&tenant); | |
| let bytes = self.storage.get_object(&path, &tenant).await?; | |
| Ok(serde_json::from_slice::<AlertTargetPolicyConfig>(&bytes)?) | |
| } | |
| async fn get_outbound_policy( | |
| &self, | |
| tenant_id: &str, | |
| ) -> Result<AlertTargetPolicyConfig, MetastoreError> { | |
| let tenant = if tenant_id == DEFAULT_TENANT { | |
| None | |
| } else { | |
| Some(tenant_id.to_string()) | |
| }; | |
| let path = outbound_http_policy_json_path(&tenant); | |
| match self.storage.get_object(&path, &tenant).await { | |
| Ok(bytes) => Ok(serde_json::from_slice::<AlertTargetPolicyConfig>(&bytes)?), | |
| Err(err) if is_missing_optional_dir(&err) => Ok(AlertTargetPolicyConfig::default()), | |
| Err(err) => Err(MetastoreError::ObjectStorageError(err)), | |
| } | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/metastore/metastores/object_store_metastore.rs` around lines 1258 - 1270,
`get_outbound_policy` currently propagates a missing-object storage error
instead of treating it as “no policy configured,” which makes single-tenant
policy loads fail unexpectedly. Update
`ObjectStoreMetastore::get_outbound_policy` to mirror the missing-file handling
used in `get_outbound_policies` by detecting the optional-missing case from
`self.storage.get_object` and returning the appropriate default/absence behavior
instead of `?`. Keep the existing path/tenant logic intact, and make sure
callers like `load_policy_for_tenant` can resolve cleanly for tenants without a
stored policy.
1 participant
Fixes #XXXX.
Description
This PR hardens alert target delivery against server-side request forgery by adding an outbound policy for alert-target HTTP
requests.
Previously, authenticated users with alert target permissions could configure webhook, Slack, or AlertManager targets that
caused the Parseable server to send outbound HTTP requests to arbitrary URLs from the server’s network position. That meant
private/internal destinations, loopback services, link-local metadata endpoints, and other network-restricted HTTP services
could be reached if routable from the Parseable host.
The chosen fix is to centralize alert-target outbound networking behind a policy gate. Instead of validating only the submitted
URL string, Parseable now resolves the destination, validates the resolved IPs, applies admin-owned allow/deny policy, disables
redirects/proxies, pins the resolved DNS result into the HTTP client, and revalidates again immediately before alert delivery.
Key changes made in this patch:
Added alert target outbound policy configuration with:
Added super-admin APIs for reading, updating, and validating the alert target policy.
Applied outbound policy validation during target creation and update.
Revalidated outbound policy during alert delivery because stored targets and DNS answers can change after creation.
Blocked private, loopback, link-local, multicast, reserved, and other non-public destinations by default.
Allowed private/internal destinations only when explicitly enabled by admin policy and matched by an allowlist.
Made denied CIDRs/domains take precedence over allowlists.
Disabled redirects and proxy use for alert target delivery.
Pinned resolved DNS addresses into reqwest before sending.
Added focused unit tests for the important policy decision paths.
This PR has:
Summary by CodeRabbit