From d796c619460bc7faa3ccafdd6bc22b104e10eb2e Mon Sep 17 00:00:00 2001 From: Will Browne Date: Tue, 24 Nov 2020 10:42:54 +0100 Subject: [PATCH] Security: Fixes minor security issue with alert notification webhooks that allowed GET & DELETE requests #29330 --- pkg/services/notifications/webhook.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/services/notifications/webhook.go b/pkg/services/notifications/webhook.go index 13679949c9f..819f0458300 100644 --- a/pkg/services/notifications/webhook.go +++ b/pkg/services/notifications/webhook.go @@ -48,6 +48,10 @@ func (ns *NotificationService) sendWebRequestSync(ctx context.Context, webhook * webhook.HttpMethod = http.MethodPost } + if webhook.HttpMethod != http.MethodPost && webhook.HttpMethod != http.MethodPut { + return fmt.Errorf("webhook only supports HTTP methods PUT or POST") + } + request, err := http.NewRequest(webhook.HttpMethod, webhook.Url, bytes.NewReader([]byte(webhook.Body))) if err != nil { return err