Félix Malfait
610c0ebc9d
## Summary - Refactors SSRF protection from a request-level adapter to connection-level agents, validating resolved IPs in `createConnection` + socket `lookup` events - Sets both `httpAgent` and `httpsAgent` so validation applies regardless of protocol switches during redirects - Caps `maxRedirects` to 10 as defense in depth ## Test plan - [x] All 59 existing + new unit tests pass (agent util, isPrivateIp, service) - [x] No linter errors - [ ] Verify webhook delivery still works with URLs that redirect - [ ] Verify image upload from external URLs still works (relies on redirect following) Made with [Cursor](https://cursor.com) <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Changes core outbound HTTP security behavior and redirect handling, which could impact webhook/image-fetch flows and connection semantics despite improved SSRF coverage. > > **Overview** > Refactors outbound SSRF protection from a custom axios `adapter` to connection-level `httpAgent`/`httpsAgent` created by new `createSsrfSafeAgent`, which blocks private IP literals up front and validates DNS-resolved IPs via the socket `lookup` event. > > When safe mode is enabled, `SecureHttpClientService.getHttpClient` now always installs both agents and enforces a capped `maxRedirects` (default `5`), and the old `getSecureAxiosAdapter` implementation/tests/types are removed. `isPrivateIp` is tightened/expanded to treat `0.0.0.0/8` as private and avoid misclassifying bare IPv4 decimals as IPv6. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 8261da4ff05ba3bca3318ad647c04faf6603d91a. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
The #1 Open-Source CRM
🌐 Website · 📚 Documentation · 
Roadmap · 
Discord · 
Figma
Installation
See: 🚀 Self-hosting 🖥️ Local Setup
Does the world need another CRM?
We built Twenty for three reasons:
CRMs are too expensive, and users are trapped. Companies use locked-in customer data to hike prices. It shouldn't be that way.
A fresh start is required to build a better experience. We can learn from past mistakes and craft a cohesive experience inspired by new UX patterns from tools like Notion, Airtable or Linear.
We believe in Open-source and community. Hundreds of developers are already building Twenty together. Once we have plugin capabilities, a whole ecosystem will grow around it.
What You Can Do With Twenty
Please feel free to flag any specific needs you have by creating an issue.
Below are a few features we have implemented to date:
- Personalize layouts with filters, sort, group by, kanban and table views
- Customize your objects and fields
- Create and manage permissions with custom roles
- Automate workflow with triggers and actions
- Emails, calendar events, files, and more
Personalize layouts with filters, sort, group by, kanban and table views
Customize your objects and fields
Create and manage permissions with custom roles
Automate workflow with triggers and actions
Emails, calendar events, files, and more
Stack
- TypeScript
- Nx
- NestJS, with BullMQ, PostgreSQL, Redis
- React, with Recoil, Emotion and Lingui
Thanks
Thanks to these amazing services that we use and recommend for UI testing (Chromatic), code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
- Star the repo
- Subscribe to releases (watch -> custom -> releases)
- Follow us on Twitter or LinkedIn
- Join our Discord
- Improve translations on Crowdin
- Contributions are, of course, most welcome!