Ruben Fiszel fb2bdc6a53 SSRF protection for SAML and MCP OAuth endpoints (#8473) ...

* fix: add SSRF protection to SAML and MCP OAuth endpoints

- Add shared SSRF URL validation utility (windmill-common/ssrf.rs) that blocks private/loopback/link-local IPs and validates DNS resolution
- Move test_metadata to authed service requiring superadmin access
- Strip response body from SAML metadata parsing errors
- Add SSRF blocklist to MCP OAuth discover, start, and client registration endpoints

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref.txt for SSRF fix

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref.txt

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update ee-repo-ref to 563877bf1c8b4184f638bab51be89b1c0aec6dad

This commit updates the EE repository reference after PR #471 was merged in windmill-ee-private.

Previous ee-repo-ref: a600fe1807ea267f87a57360f4b48bf917776723

New ee-repo-ref: 563877bf1c8b4184f638bab51be89b1c0aec6dad

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

2026-03-22 17:18:22 +00:00

..

runnable_settings

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

secret_backend

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

agent_workers.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

ai_bedrock.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

ai_google.rs

refactor: extract google ai logic to windmill-common and use native gemini api in chat proxy (#8115)

2026-03-09 15:15:37 +00:00

ai_providers.rs

feat: add Vertex AI support for Google Gemini models (#8303)

2026-03-10 18:20:19 +00:00

ai_types.rs

refactor: extract object store into dedicated crate with filesystem backend (#7996)

2026-02-18 12:24:45 +00:00

apps.rs

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

assets.rs

feat: add sandbox annotations, volume mounts, for AI sandbox starting with claude (#8058)

2026-03-05 06:19:51 +00:00

audit.rs

fix(backend): add presigned url support for object storage (#7328)

2025-12-10 15:35:26 +00:00

auth.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

bench.rs

feat: make WINDMILL_DIR configurable via environment variable (#8215)

2026-03-04 08:53:25 +00:00

cache.rs

feat: script module mode with CLI sync, preview, and WAC UI improvements (#8380)

2026-03-17 01:20:09 +00:00

client.rs

feat: env var in flow (#6852)

2025-11-07 18:38:55 +00:00

db.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

ee_oss.rs

EE Refactor (#5844)

2025-06-02 22:12:33 +02:00

email_oss.rs

refactor: extract windmill-api-scripts and windmill-api-users subcrates (#7850)

2026-02-08 12:12:03 +00:00

error.rs

feat: workflow-as-code (WAC) v2 (#8172)

2026-03-09 19:39:24 +00:00

external_ip.rs

feat(internal): runnable settings (#7298)

2025-12-16 21:17:06 +00:00

flow_conversations.rs

refactor: extract windmill-dep-map crate for parallel api/worker compilation (#7846)

2026-02-08 00:39:56 +00:00

flow_status.rs

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

flows.rs

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

git_sync_oss.rs

feat: add GitHub Enterprise Server (GHES) support for GitHub App git sync (#8344)

2026-03-13 08:21:15 +00:00

global_settings.rs

feat: DB-backed instance events webhook with superadmin UI (#8402)

2026-03-17 15:26:04 +00:00

indexer.rs

fix: lower default indexer memory/batch settings to prevent OOM (#8347)

2026-03-13 06:03:45 +00:00

instance_config.rs

feat: DB-backed instance events webhook with superadmin UI (#8402)

2026-03-17 15:26:04 +00:00

job_metrics.rs

perf: optimize job_stats storage for timestamps and zero-memory jobs (#8289)

2026-03-10 04:59:56 +00:00

jobs.rs

feat: make WINDMILL_DIR configurable via environment variable (#8215)

2026-03-04 08:53:25 +00:00

jwt.rs

feat: use S3 Proxy for duckdb instead of direct connection (#6505)

2025-09-03 15:03:44 +00:00

lib.rs

SSRF protection for SAML and MCP OAuth endpoints (#8473)

2026-03-22 17:18:22 +00:00

lockfiles.rs

fix: dep jobs improvements (#7081)

2025-11-07 11:04:53 +00:00

min_version.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

more_serde.rs

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

notify_events.rs

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00

oauth2.rs

feat: add LOGIN_DOMAIN env var to normalize emails during external login

2026-01-27 00:01:35 +00:00

oidc_oss.rs

feat: add end_user_email claim to OIDC ID tokens (#8401)

2026-03-17 00:17:03 +00:00

otel_oss.rs

feat: add OTel metrics support (#8442)

2026-03-19 08:10:37 +00:00

queue.rs

feat: add prometheus metric queue_running_count (#6413)

2025-08-19 22:12:36 +00:00

result_stream.rs

use excluded where relevant

2025-10-16 09:19:44 +00:00

runtime_assets.rs

feat: option to preserve on_behalf_of and edited_by for admins and users in the new wm_deployers group (#8079)

2026-02-25 12:05:22 +00:00

schedule.rs

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

schema.rs

feat: workspace dependencies (#7124)

2025-11-28 16:00:11 +00:00

scripts.rs

feat: script module mode with CLI sync, preview, and WAC UI improvements (#8380)

2026-03-17 01:20:09 +00:00

server.rs

allow no tls for instance settings smtp (#4656)

2024-11-06 16:58:24 +01:00

ssrf.rs

SSRF protection for SAML and MCP OAuth endpoints (#8473)

2026-03-22 17:18:22 +00:00

stats_oss.rs

improve analytics (#8418)

2026-03-17 20:14:02 +00:00

stream.rs

fix: add size limit to indexer queries on jobs table to avoid oom (#6293)

2025-07-29 18:27:59 +00:00

teams_oss.rs

feat(internal): runnable settings (#7298)

2025-12-16 21:17:06 +00:00

tracing_init.rs

feat: make WINDMILL_DIR configurable via environment variable (#8215)

2026-03-04 08:53:25 +00:00

triggers.rs

refactor: extract windmill-types crate from windmill-common (#7851)

2026-02-08 14:15:07 +00:00

usernames.rs

refactor: extract 12 leaf crates from windmill-api (#7899)

2026-02-11 10:31:03 +00:00

users.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

utils.rs

fix: improve windows compatibility

2026-03-04 20:20:18 +00:00

variables.rs

feat: nextcloud native triggers (#6797)

2026-01-26 16:49:52 +00:00

webhook.rs

feat: DB-backed instance events webhook with superadmin UI (#8402)

2026-03-17 15:26:04 +00:00

worker_group_job_stats.rs

fix nits worker group stats

2025-09-11 09:19:09 +00:00

worker.rs

feat: script module mode with CLI sync, preview, and WAC UI improvements (#8380)

2026-03-17 01:20:09 +00:00

workspace_dependencies.rs

feat: add workspace dependencies support for powershell (#8395)

2026-03-16 15:37:28 +00:00

workspaces.rs

test: git sync E2E tests + auto-manage git sync script version (#8253)

2026-03-12 12:48:38 +00:00