From 52825af3cd4e881a796002c9833c7c3b8999d7c7 Mon Sep 17 00:00:00 2001
From: Sam Machin <sam@sammachin.com>
Date: Fri, 19 Dec 2025 11:16:19 +0000
Subject: [PATCH] calidate webhook urls on update

---
 lib/routes/api/applications.js | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/lib/routes/api/applications.js b/lib/routes/api/applications.js
index 6020bec..19dc663 100644
--- a/lib/routes/api/applications.js
+++ b/lib/routes/api/applications.js
@@ -101,6 +101,20 @@ async function validateUpdate(req, sid) {
   if (req.body.call_status_hook && typeof req.body.call_hook !== 'object') {
     throw new DbErrorBadRequest('\'call_status_hook\' must be an object when updating an application');
   }
+
+  let urlError;
+  if (req.body.call_hook.url) {
+    urlError = await isInvalidUrl(req.body.call_hook.url);
+    if (urlError) {
+      throw new DbErrorBadRequest(`call_hook ${urlError}`);
+    }
+  }
+  if (req.body.call_status_hook.url) {
+    urlError = await isInvalidUrl(req.body.call_status_hook.url);
+    if (urlError) {
+      throw new DbErrorBadRequest(`call_status_hook ${urlError}`);
+    }
+  }
 }
 
 async function validateDelete(req, sid) {