fix(webapp): block benchmarking IP range for alert webhooks (#84)

Author: carderne

.server-changes/reject-benchmarking-webhook-addresses.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Reject alert webhook destinations in reserved benchmarking IP ranges.

apps/webapp/app/v3/services/alerts/safeWebhookUrl.server.ts

@@ -42,6 +42,8 @@ function isUnsafeIPv4(host: string): boolean {
   if (a === 169 && b === 254) return true;
   // 100.64/10 carrier-grade NAT
   if (a === 100 && b >= 64 && b <= 127) return true;
+  // 198.18/15 benchmarking
+  if (a === 198 && b >= 18 && b <= 19) return true;
   // 224/4 multicast
   if (a >= 224 && a <= 239) return true;
   // 240/4 reserved

apps/webapp/test/safeWebhookUrl.test.ts

@@ -48,8 +48,15 @@ describe("assertSafeWebhookUrl", () => {
     ).rejects.toBeInstanceOf(UnsafeWebhookUrlError);
   });
 
-  it("rejects CGNAT, multicast and reserved ranges", async () => {
-    for (const host of ["100.64.0.1", "224.0.0.1", "239.1.1.1", "240.0.0.1"]) {
+  it("rejects CGNAT, benchmarking, multicast and reserved ranges", async () => {
+    for (const host of [
+      "100.64.0.1",
+      "198.18.0.0",
+      "198.19.255.255",
+      "224.0.0.1",
+      "239.1.1.1",
+      "240.0.0.1",
+    ]) {
       await expect(assertSafeWebhookUrl(`http://${host}/hook`)).rejects.toBeInstanceOf(
         UnsafeWebhookUrlError
       );
@@ -92,6 +99,8 @@ describe("assertSafeWebhookUrl", () => {
 describe("assertAddressAllowed", () => {
   it("allows public IPv4 / IPv6 addresses", () => {
     expect(() => assertAddressAllowed("93.184.216.34", 4)).not.toThrow();
+    expect(() => assertAddressAllowed("198.17.255.255", 4)).not.toThrow();
+    expect(() => assertAddressAllowed("198.20.0.0", 4)).not.toThrow();
     expect(() => assertAddressAllowed("2606:2800:220:1:248:1893:25c8:1946", 6)).not.toThrow();
   });
 
@@ -104,6 +113,8 @@ describe("assertAddressAllowed", () => {
       "192.168.1.1",
       "169.254.169.254",
       "100.64.0.1",
+      "198.18.0.0",
+      "198.19.255.255",
     ]) {
       expect(() => assertAddressAllowed(addr, 4)).toThrow(UnsafeWebhookUrlError);
     }