fix(webhook): Support verification of redirected urls (#3049)

```
public boolean isRedirect() {
    switch (code) {
      case HTTP_PERM_REDIRECT:
      case HTTP_TEMP_REDIRECT:
      case HTTP_MULT_CHOICE:
      case HTTP_MOVED_PERM:
      case HTTP_MOVED_TEMP:
      case HTTP_SEE_OTHER:
        return true;
      default:
        return false;
    }
  }
```

In the event that a redirect is detected, the value of the `Location`
header will be checked against `UserConfiguredUrlRestrictions`.

Can be disabled by setting `webhook.verifyRedirects: false`

orca-webhook/src/main/java/com/netflix/spinnaker/orca/webhook/config/WebhookConfiguration.java

@@ -18,6 +18,7 @@
 package com.netflix.spinnaker.orca.webhook.config;
 
 import com.netflix.spinnaker.okhttp.OkHttpClientConfigurationProperties;
+import com.netflix.spinnaker.orca.config.UserConfiguredUrlRestrictions;
 import com.netflix.spinnaker.orca.webhook.util.UnionX509TrustManager;
 import java.io.FileInputStream;
 import java.io.IOException;
@@ -35,6 +36,7 @@
 import java.util.Optional;
 import javax.net.ssl.*;
 import okhttp3.OkHttpClient;
+import okhttp3.Response;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
@@ -83,11 +85,28 @@ public RestTemplate restTemplate(ClientHttpRequestFactory webhookRequestFactory)
 
   @Bean
   public ClientHttpRequestFactory webhookRequestFactory(
-      OkHttpClientConfigurationProperties okHttpClientConfigurationProperties) {
+      OkHttpClientConfigurationProperties okHttpClientConfigurationProperties,
+      UserConfiguredUrlRestrictions userConfiguredUrlRestrictions) {
     X509TrustManager trustManager = webhookX509TrustManager();
     SSLSocketFactory sslSocketFactory = getSSLSocketFactory(trustManager);
     OkHttpClient client =
-        new OkHttpClient.Builder().sslSocketFactory(sslSocketFactory, trustManager).build();
+        new OkHttpClient.Builder()
+            .sslSocketFactory(sslSocketFactory, trustManager)
+            .addNetworkInterceptor(
+                chain -> {
+                  Response response = chain.proceed(chain.request());
+
+                  if (webhookProperties.isVerifyRedirects() && response.isRedirect()) {
+                    // verify that we are not redirecting to a restricted url
+                    String redirectLocation = response.header("Location");
+                    if (redirectLocation != null && !redirectLocation.trim().startsWith("/")) {
+                      userConfiguredUrlRestrictions.validateURI(redirectLocation);
+                    }
+                  }
+
+                  return response;
+                })
+            .build();
     OkHttp3ClientHttpRequestFactory requestFactory = new OkHttp3ClientHttpRequestFactory(client);
     requestFactory.setReadTimeout(
         Math.toIntExact(okHttpClientConfigurationProperties.getReadTimeoutMs()));

orca-webhook/src/main/java/com/netflix/spinnaker/orca/webhook/config/WebhookProperties.java

@@ -51,6 +51,8 @@ public class WebhookProperties {
   private List<PreconfiguredWebhook> preconfigured = new ArrayList<>();
   private TrustSettings trust;
 
+  private boolean verifyRedirects = true;
+
   @Data
   @NoArgsConstructor
   public static class TrustSettings {

orca-webhook/src/test/groovy/com/netflix/spinnaker/orca/webhook/service/WebhookServiceSpec.groovy

@@ -49,13 +49,16 @@ class WebhookServiceSpec extends Specification {
   def webhookConfiguration = new WebhookConfiguration(webhookProperties)
 
   @Shared
-  def requestFactory = webhookConfiguration.webhookRequestFactory(okHttpClientConfigurationProperties)
+  def userConfiguredUrlRestrictions = new UserConfiguredUrlRestrictions.Builder().withRejectLocalhost(false).build()
 
   @Shared
-  def restTemplateProvider = new DefaultRestTemplateProvider(webhookConfiguration.restTemplate(requestFactory))
+  def requestFactory = webhookConfiguration.webhookRequestFactory(
+    okHttpClientConfigurationProperties,
+    userConfiguredUrlRestrictions
+  )
 
   @Shared
-  def userConfiguredUrlRestrictions = new UserConfiguredUrlRestrictions.Builder().withRejectLocalhost(false).build()
+  def restTemplateProvider = new DefaultRestTemplateProvider(webhookConfiguration.restTemplate(requestFactory))
 
   def preconfiguredWebhookProperties = new WebhookProperties()