fix(webhook): enforce URL admission at storage boundary

.jules/sentinel.md

@@ -127,3 +127,7 @@
 **Vulnerability:** The `/api/v1/webhook` POST endpoint in `appguardrail_core/controlplane.py` failed to validate the `url` property when accepting it into the database, leading to Stored SSRF risks. In addition, the core SSRF validation logic (`_is_safe_url`) in both the CLI and control-plane did not verify the input type (e.g. `isinstance(url, str)`). Passing non-string types (like integers) resulted in unhandled `AttributeError` exceptions inside `urllib.parse.urlparse`, which led to API 500 crashes on malicious JSON payloads.
 **Learning:** Network endpoints must explicitly validate the data type of user-provided configurations prior to execution or storage. Furthermore, webhooks configured by users should always be checked for SSRF when saved, as trusting them later assumes input has already been safely validated, bypassing downstream network guardrails.
 **Prevention:** Apply `_is_safe_url` checks directly upon ingestion (e.g., in `/api/v1/webhook`) and enforce type checks `if not isinstance(url, str): return False` prior to using library parsing functions like `urlparse`. Always return gracefully failing responses (like `400 Bad Request`) for unsafe URLs instead of allowing unhandled 500 server errors.
+## 2024-05-24 - [Defense in Depth for Stored SSRF]
+**Vulnerability:** Webhook URLs could potentially be stored without validation if `set_webhook` is called outside the immediate HTTP handler, leading to Stored SSRF.
+**Learning:** Security validation (`_is_safe_url`) must be enforced at the lowest level (e.g., prior to database insertion) to ensure no bypass is possible via other application paths.
+**Prevention:** Always validate user-provided URLs intended for backend storage immediately before inserting them into the database.

appguardrail_core/controlplane.py

@@ -137,6 +137,8 @@ def _drift_fp(finding: dict[str, Any]) -> str:
 
 def set_webhook(conn: sqlite3.Connection, org_id: int, url: "str | None") -> None:
     """Set (or clear) the org's drift-alert webhook URL."""
+    if url is not None and not _is_safe_url(url):
+        raise ValueError("Invalid webhook URL")
     conn.execute("UPDATE orgs SET webhook_url = ? WHERE id = ?", (url or None, org_id))
     conn.commit()