security: timing-safe API key, SSRF webhook guard, API no-cache, Referrer-Policy

backend/webhook.js

@@ -2,12 +2,29 @@ const { query, getRow } = require('./db');
 
 const EVENT_LABELS = { ticket_created:'工单创建', ticket_claimed:'工单认领', ticket_transferred:'工单转交', ticket_updated:'工单更新' };
 
+const dns = require('dns').promises;
+const { URL } = require('url');
+
+async function isPrivateUrl(urlStr) {
+  try {
+    const u = new URL(urlStr);
+    if (u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '0.0.0.0') return true;
+    if (u.hostname.startsWith('192.168.') || u.hostname.startsWith('10.') || u.hostname.startsWith('172.16.')) return true;
+    const addrs = await dns.resolve4(u.hostname).catch(() => []);
+    for (const addr of addrs) {
+      if (addr === '127.0.0.1' || addr.startsWith('192.168.') || addr.startsWith('10.') || addr.startsWith('172.16.') || addr.startsWith('0.')) return true;
+    }
+    return false;
+  } catch { return true; }
+}
+
 async function sendWebhook(event, data) {
   try {
     const configs = await query("SELECT * FROM notification_configs WHERE type = 'webhook' AND active = 1");
     for (const cfg of configs) {
       const events = cfg.events || 'all';
       if (events !== 'all' && !events.split(',').map(s=>s.trim()).includes(event)) continue;
+      if (cfg.webhook_url && await isPrivateUrl(cfg.webhook_url)) { console.error('[Webhook] blocked internal URL:', cfg.name); continue; }
       const embed = buildEmbed(event, data);
       try {
         const ctrl = new AbortController();