How Enterprises
Wipe Out Vulnerabilities

@router.post("/api/v1/webhooks/test")async def test_webhook(    req: WebhookTestRequest,    user: User = Depends(get_current_user),    policy: OrgPolicy = Depends(get_org_policy),    http: SafeHttpClient = Depends(),):    parsed = urlparse(str(req.url))    # Fix #1 (SEC-POL-007): enforce HTTPS only    if parsed.scheme != "https":        raise ValidationError("Only HTTPS supported")    # Fix #2 (CONTEXT): honor sec allowlist/kill-switch    if not policy.egress_enabled or parsed.hostname not in policy.allowlisted_domains:        raise ValidationError("Org policy blocks this destination")    resolved_ip = await http.safe_resolve(parsed.hostname)    # Fix #3 (COMPLEX): DNS pinning + private-range check
    if ip_address(resolved_ip).is_private orresolved_ip in INFRA_BLOCKLIST:
        logger.warning("SSRF blocked", extra={"user_id": user.id, "host": parsed.hostname})        raise ValidationError("Unable to reach URL")    resp = await http.get(       str(req.url),
       resolved_ip=resolved_ip,  # IP pinning preserves Host header for SNI
       timeout=settings.EXTERNAL_CALL_TIMEOUT, # ADR-0041
       follow_redirects=False,# redirect chain could bypass checks
    )    # CONVENTION: stable response contract
    return {"status": resp.status_code,"latency_ms": resp.elapsed_ms}