@checkstack/notification-backstage-backend 0.1.67 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @checkstack/notification-backstage-backend
 
+## 0.2.0
+
+### Minor Changes
+
+- 43e4484: Harden the Discord, Slack, Gotify, and Backstage channels against SSRF. Each
+  POSTs to a configured arbitrary host (Discord/Slack incoming webhook, Gotify
+  server URL, Backstage base URL); these now run the shared `validateWebhookUrl`
+  pre-flight and send with `redirect: "error"` so a receiver cannot
+  `302`-redirect the request at a blocked host past the pre-flight. The pre-flight
+  blocks only the classic exfiltration / pivot targets (loopback, `0.0.0.0/8`,
+  cloud-metadata, link-local, IPv6 ULA) and ALLOWS internal RFC1918 hosts, so
+  self-hosted internal receivers keep working. Same defense-in-depth already
+  applied to the Webhook channel. (Pushover, Telegram, Teams, and Webex POST to
+  hard-coded vendor hosts and are unaffected.)
+
+### Patch Changes
+
+- Updated dependencies [43e4484]
+- Updated dependencies [43e4484]
+- Updated dependencies [43e4484]
+- Updated dependencies [43e4484]
+- Updated dependencies [43e4484]
+- Updated dependencies [43e4484]
+  - @checkstack/backend-api@0.31.1
+  - @checkstack/notification-backend@1.7.0
+
 ## 0.1.67
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/notification-backstage-backend",
-  "version": "0.1.67",
+  "version": "0.2.0",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {
@@ -15,8 +15,8 @@
     "pack": "bunx @checkstack/scripts plugin-pack"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.31.0",
-    "@checkstack/notification-backend": "1.6.7",
+    "@checkstack/backend-api": "0.31.1",
+    "@checkstack/notification-backend": "1.7.0",
     "@checkstack/common": "0.22.0",
     "zod": "^4.2.1"
   },

package/src/index.test.ts

@@ -1,10 +1,44 @@
-import { describe, it, expect } from "bun:test";
+import { describe, it, expect, spyOn, mock } from "bun:test";
+import type { Logger } from "@checkstack/backend-api";
 import {
   backstageConfigSchemaV1,
   userConfigSchemaV1,
   mapImportanceToSeverity,
+  backstageStrategy,
 } from "./index";
 
+function makeLogger(): Logger {
+  return {
+    info: mock(() => {}),
+    error: mock(() => {}),
+    warn: mock(() => {}),
+    debug: mock(() => {}),
+  };
+}
+
+type BackstageSendContext = Parameters<typeof backstageStrategy.send>[0];
+
+function makeContext(baseUrl: string): BackstageSendContext {
+  return {
+    user: { userId: "u1", email: "u1@example.com" },
+    contact: "user:default/u1",
+    notification: {
+      title: "Alert",
+      body: "body",
+      importance: "info",
+      type: "test",
+    },
+    strategyConfig: {
+      baseUrl,
+      token: "tok",
+      defaultEntityPrefix: "user:default/",
+    },
+    userConfig: { entityRef: "user:default/u1" },
+    layoutConfig: undefined,
+    logger: makeLogger(),
+  };
+}
+
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 // Config Schema Tests
 // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
@@ -145,3 +179,47 @@ describe("backstageStrategy.send", () => {
     expect(normalizedUrl).toBe("https://backstage.example.com");
   });
 });
+
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+// SSRF hardening (configured base URL)
+// ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+describe("Backstage SSRF hardening", () => {
+  it("rejects a baseUrl that resolves to a blocked host before dispatch", async () => {
+    const fetchSpy = spyOn(globalThis, "fetch");
+    try {
+      const result = await backstageStrategy.send(
+        makeContext("http://169.254.169.254"),
+      );
+      expect(result.success).toBe(false);
+      expect(fetchSpy).not.toHaveBeenCalled();
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+
+  it("refuses redirects so a 302 to a blocked host is not followed", async () => {
+    let targetHit = false;
+    const fetchSpy = spyOn(globalThis, "fetch").mockImplementation((async (
+      _url: RequestInfo | URL,
+      init?: RequestInit,
+    ) => {
+      if (init?.redirect === "error") {
+        throw new TypeError("unexpected redirect");
+      }
+      targetHit = true;
+      return new Response(null, { status: 200 });
+    }) as unknown as typeof fetch);
+    try {
+      const result = await backstageStrategy.send(
+        makeContext("https://93.184.216.34"),
+      );
+      expect(result.success).toBe(false);
+      expect(targetHit).toBe(false);
+      const init = fetchSpy.mock.calls[0]?.[1] as RequestInit | undefined;
+      expect(init?.redirect).toBe("error");
+    } finally {
+      fetchSpy.mockRestore();
+    }
+  });
+});

package/src/index.ts

@@ -8,6 +8,7 @@ import {
 import {
   notificationStrategyExtensionPoint,
   renderSubjectsAsMarkdown,
+  validateWebhookUrl,
 } from "@checkstack/notification-backend";
 import { z } from "zod";
 import { pluginMetadata } from "./plugin-metadata";
@@ -225,6 +226,17 @@ const backstageStrategy: NotificationStrategy<
       "",
     )}/api/notifications/notifications`;
 
+    // SSRF guard: `baseUrl` is a configured arbitrary host. Reject it up front if
+    // it resolves to an internal/reserved address, and refuse redirects below so
+    // the server cannot 3xx us at an internal host past this pre-flight.
+    const validation = await validateWebhookUrl({ url });
+    if (!validation.ok) {
+      logger?.warn?.(
+        `Blocked Backstage delivery to ${url}: ${validation.error}`,
+      );
+      return { success: false, error: validation.error };
+    }
+
     try {
       logger?.debug?.("Sending notification to Backstage", {
         url,
@@ -239,6 +251,7 @@ const backstageStrategy: NotificationStrategy<
           Authorization: `Bearer ${strategyConfig.token}`,
         },
         body: JSON.stringify(payload),
+        redirect: "error",
       });
 
       if (!response.ok) {
@@ -306,6 +319,11 @@ export default createBackendPlugin({
  * public API surface.
  * @internal
  */
-export { backstageConfigSchemaV1, userConfigSchemaV1, mapImportanceToSeverity };
+export {
+  backstageConfigSchemaV1,
+  userConfigSchemaV1,
+  mapImportanceToSeverity,
+  backstageStrategy,
+};
 /** @internal */
 export type { BackstageConfig, BackstageUserConfig };