From 7b6540a748a90c10f41b931450ac809e7ae23c01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mathias=20Sch=C3=BCpany?= Date: Sun, 29 Mar 2026 11:32:04 +0200 Subject: [PATCH] fix: Adapt SNS Webhook validation regex pattern to also support AWS eusc partition --- apps/api/src/controllers/Webhooks.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/apps/api/src/controllers/Webhooks.ts b/apps/api/src/controllers/Webhooks.ts index 0c597f9..5d85c16 100644 --- a/apps/api/src/controllers/Webhooks.ts +++ b/apps/api/src/controllers/Webhooks.ts @@ -53,8 +53,8 @@ export class Webhooks { } // Only allow HTTPS requests to official AWS SNS endpoints. - // The hostname must be exactly sns..amazonaws.com. - const SNS_HOST_RE = /^sns\.[a-z0-9-]+\.amazonaws\.com$/; + // The hostname must be exactly sns..amazonaws.com or sns..amazonaws.eu + const SNS_HOST_RE = /^sns\.[a-z0-9-]+\.amazonaws\.(com|eu)$/; if (parsedURL.protocol !== 'https:' || !SNS_HOST_RE.test(parsedURL.hostname)) { signale.warn(`SNS SubscriptionConfirmation rejected — disallowed SubscribeURL host: ${parsedURL.hostname}`); return res.status(400).json({success: false, message: 'Invalid SubscribeURL'});