feat(admin-ui): Implement security measures for webhook

admin-ui/plugins/admin/components/Webhook/WebhookForm.js

@@ -25,6 +25,7 @@ import GluuTypeAhead from 'Routes/Apps/Gluu/GluuTypeAhead'
 import GluuProperties from 'Routes/Apps/Gluu/GluuProperties'
 import ShortcodePopover from './ShortcodePopover'
 import shortCodes from 'Plugins/admin/helper/shortCodes.json'
+import { isValid } from './WebhookURLChecker'
 
 const WebhookForm = () => {
   const { id } = useParams()
@@ -63,6 +64,14 @@ const WebhookForm = () => {
         )
       }
     }
+    const isCool = isValid(values.url)
+    if (isValid(values.url) === false) {
+      faulty = true
+      formik.setFieldError(
+        'url',
+        "Invalid url or url not allowed."
+      )
+    }
 
     return faulty
   }
@@ -85,11 +94,9 @@ const WebhookForm = () => {
     },
     onSubmit: (values) => {
       const faulty = validatePayload(values)
-
       if (faulty) {
         return
       }
-
       toggle()
     },
     validationSchema: Yup.object().shape({

admin-ui/plugins/admin/components/Webhook/WebhookURLChecker.js

@@ -0,0 +1,19 @@
+const NOT_ALLOWED = ["http://", "ftp://", "file://", "telnet://", "smb://", "ssh://", "ldap://", "https://192.168", "https://127.0", "https://172", "https://localhost"]
+export const isValid = (url) => {
+    if (url === undefined || url === null) {
+        return false;
+    } else {
+        return isAllowed(url)
+    }
+}
+
+const isAllowed = (url) => {
+    let result = true;
+    for (let extention in NOT_ALLOWED) {
+        if (url.startsWith(NOT_ALLOWED[extention])) {
+            result = false;
+            break;
+        }
+    }
+    return result;
+}