3 Commits

Author	SHA1	Message	Date
Jeremy Daer	ea8a78cc22	Fix stale-read race when creating push subscriptions ... (Caught one such uniqueness exception in the wild) * 200 OK -> 204 No Content, default status * No need to touch the subscription when found * Drop superflous test	2025-12-09 01:34:37 -08:00
Jeremy Daer	496851b255	Security: Web Push SSRF and IP range bypass ... Add SSRF protection for web push endpoints: - Resolve endpoint IP once and pin it for connection - Validate endpoints resolve to public IPs - Whitelist permitted push service hosts Add missing IP ranges to SsrfProtection: - 100.64.0.0/10 (Carrier-grade NAT, RFC6598) - 198.18.0.0/15 (Benchmark testing, RFC2544) Note: link-local (169.254.0.0/16) is already covered by ip.link_local?	2025-12-04 21:35:55 -08:00
Jason Zimdars	f6d8d3021d	Add controller test	2025-07-21 20:06:41 -05:00