feat: Add configurable proxy for outgoing traffic to prevent SSRF

server/api/helpers/utils/download-favicon.js

@@ -4,6 +4,7 @@
  */
 
 const { URL } = require('url');
+const { ProxyAgent } = require('undici');
 const icoToPng = require('ico-to-png');
 const sharp = require('sharp');
 
@@ -20,6 +21,9 @@ const fetchWithTimeout = (url) => {
 
   return fetch(url, {
     signal: abortController.signal,
+    dispatcher: sails.config.custom.outgoingProxy
+      ? new ProxyAgent(sails.config.custom.outgoingProxy)
+      : undefined,
   });
 };
 

server/api/helpers/utils/make-smtp-transporter.js

@@ -23,6 +23,11 @@ module.exports = {
 
       if (config.smtpHost) {
         sourceConfig = config;
+
+        // TODO: hack to make it work with proxy
+        if (sourceConfig.smtpPort === null) {
+          sourceConfig.smtpPort = sourceConfig.smtpSecure ? 465 : 587;
+        }
       }
     }
 
@@ -47,6 +52,10 @@ module.exports = {
         tls: {
           rejectUnauthorized: sourceConfig.smtpTlsRejectUnauthorized,
         },
+        proxy:
+          sails.config.custom.outgoingProxy && !sails.config.custom.smtpHost
+            ? sails.config.custom.outgoingProxy
+            : undefined,
       },
       {
         from: sourceConfig.smtpFrom,

server/api/helpers/utils/send-notifications.js

@@ -26,12 +26,21 @@ module.exports = {
 
   async fn(inputs) {
     try {
-      await promisifyExecFile(`${sails.config.appPath}/.venv/bin/python3`, [
-        `${sails.config.appPath}/utils/send_notifications.py`,
-        JSON.stringify(inputs.services),
-        inputs.title,
-        JSON.stringify(inputs.bodyByFormat),
-      ]);
+      await promisifyExecFile(
+        `${sails.config.appPath}/.venv/bin/python3`,
+        [
+          `${sails.config.appPath}/utils/send_notifications.py`,
+          JSON.stringify(inputs.services),
+          inputs.title,
+          JSON.stringify(inputs.bodyByFormat),
+        ],
+        {
+          env: {
+            HTTP_PROXY: sails.config.custom.outgoingProxy,
+            HTTPS_PROXY: sails.config.custom.outgoingProxy,
+          },
+        },
+      );
     } catch (error) {
       sails.log.error(`Error sending notifications: ${error.stderr || error.message}`);
     }

server/api/helpers/utils/send-webhooks.js

@@ -3,6 +3,8 @@
  * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
  */
 
+const { ProxyAgent } = require('undici');
+
 const Webhook = require('../../models/Webhook');
 
 /**
@@ -61,6 +63,9 @@ async function sendWebhook(webhook, event, data, prevData, user) {
       headers,
       body,
       method: 'POST',
+      dispatcher: sails.config.custom.outgoingProxy
+        ? new ProxyAgent(sails.config.custom.outgoingProxy)
+        : undefined,
     });
 
     if (!response.ok) {