Localhost bypass with DNS

Code reviewCode quality & reviewSenior–Staff~30 min

Review this Go handler that fetches a user-supplied webhook URL for validation.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 30 min

Mark a line and say what kind of problem it is.0 findings

1func validateWebhook(w http.ResponseWriter, r *http.Request) {

2 target := r.URL.Query().Get("url")

3 u, err := url.Parse(target)

4 if err != nil || (u.Scheme != "http" && u.Scheme != "https") {

5 http.Error(w, "bad url", 400); return

6 }

7 if strings.Contains(u.Host, "169.254.169.254") {

8 http.Error(w, "forbidden", 403); return

9 }

10 resp, err := http.Get(target)

11 if err != nil { http.Error(w, "fetch failed", 502); return }

12 defer resp.Body.Close()

13 body, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))

14 w.Write(body)

15}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.