From fc68d2eb948f764c0b5131e41ab2cf9c0084d6d2 Mon Sep 17 00:00:00 2001
From: Nivokvo Bounty Hunter <agent@nivokvo.dev>
Date: Wed, 29 Jul 2026 16:36:58 +0300
Subject: [PATCH] fix(webhooks): strip trailing dot from hostname to block
 root-dotted internal hosts

Fixes #60.
---
 lib/url-guard.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/url-guard.ts b/lib/url-guard.ts
index eade374..b571e57 100644
--- a/lib/url-guard.ts
+++ b/lib/url-guard.ts
@@ -8,7 +8,7 @@ export function isInternalUrl(raw: string): boolean {
   // Reject non-numeric ports; odd ports can hide alternate protocols.
   if (u.port !== "" && !/^\d{1,5}$/.test(u.port)) return true;
 
-  const h = u.hostname.toLowerCase();
+  const h = u.hostname.toLowerCase().replace(/\.$/, "");
   if (h === "localhost" || h.endsWith(".localhost") || h === "metadata.google.internal") return true;
   if (h === "0.0.0.0") return true;