From 60a171b19efd515d9213b535d52a2bcbec3ff2fe Mon Sep 17 00:00:00 2001 From: Alex Rosenzweig <64241648+shellz-n-stuff@users.noreply.github.com> Date: Fri, 24 Jul 2026 19:24:47 -0700 Subject: [PATCH] fix(workflow): bypass system proxies for webhooks (#2800) ## Summary Disable automatic system-proxy discovery for workflow webhook requests. ## Why Webhook destinations are resolved, validated, and pinned before the request to prevent DNS-rebinding SSRF. If reqwest uses a system proxy, the proxy can resolve the original hostname itself instead of connecting to the validated address, bypassing that pinning guarantee. Calling `no_proxy()` keeps these security-sensitive requests on the directly validated connection path. Redirects remain disabled. ## Test plan - `cargo fmt --all -- --check` - `cargo test -p buzz-workflow --features reqwest` (149 passed) - `cargo clippy -p buzz-workflow --all-targets --features reqwest -- -D warnings` - `git diff --check` Co-authored-by: Amp --- crates/buzz-workflow/src/executor.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/crates/buzz-workflow/src/executor.rs b/crates/buzz-workflow/src/executor.rs index a029b4462..e30541377 100644 --- a/crates/buzz-workflow/src/executor.rs +++ b/crates/buzz-workflow/src/executor.rs @@ -805,6 +805,9 @@ async fn call_webhook_impl( // different address than the one validated above (DNS rebinding TOCTOU). let client = Client::builder() .timeout(Duration::from_secs(10)) + // A system proxy would resolve the original hostname itself, bypassing + // the validated and pinned address above. + .no_proxy() // Disable redirects — a redirect to an internal host bypasses the SSRF check. .redirect(reqwest::redirect::Policy::none()) .resolve(host, std::net::SocketAddr::new(safe_ip, port))