Senti-Man

Insufficient validation of a station's Remote Relay URL allows a user with station-scoped RemoteRelays permissions to perform server-side request forgery (SSRF). The system only checks for URL syntax and http/https schemes via the `parseUserUrl()` function (used by `getUrlAsUri()`), failing to restrict host or IP addresses. This allows the configuration of URLs pointing to loopback, private-network, or cloud-metadata addresses. Consequently, the periodic background Now Playing sync performed by the `getNowPlayingAsync()` function automatically issues HTTP requests to these internal resources.

An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks.