Jeremy Daer 7d5bb50b9b Address push-SSRF review: defer DNS off enqueue path, disable proxy on pinned path, revalidate on re-registration ...

- Resolve the guarded endpoint IP lazily inside WebPush::Notification#deliver
  (on the bounded delivery worker) instead of eagerly when the notification is
  built on the serial enqueue path, so a slow resolver can't stall the push job
  before any delivery starts. resolved_endpoint_ip only reads the already-loaded
  endpoint attribute, so it is safe off the AR connection.
- Pin the delivery socket with an explicit nil proxy address so http_proxy/
  https_proxy can't route the request through a proxy that re-resolves the host
  and defeats the ipaddr pin.
- Revalidate an existing subscription on re-registration so a row predating
  endpoint validation gets the same 422 as a fresh create instead of being kept
  alive by touch.
- Regression tests: resolution deferred to delivery, pin survives proxy env,
  legacy invalid row rejected with 422.

2026-08-26 00:03:15 -07:00

..

avatars_controller_test.rb

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

bans_controller_test.rb

Add IP-based user banning

2025-11-26 14:30:38 +00:00

profiles_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00

push_subscriptions_controller_test.rb

Address push-SSRF review: defer DNS off enqueue path, disable proxy on pinned path, revalidate on re-registration

2026-08-26 00:03:15 -07:00

sidebars_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00