fix(notify): 自定义 Webhook 推送本地/内网目标绕过代理 - #446
Open
ArmedHelicopter wants to merge 2 commits into
Open
Conversation
httpx 默认 trust_env=True 会读取环境变量中的代理设置，导致发往 localhost/内网的自定义 Webhook 推送被系统代理（如 Clash）劫持； 代理拨号失败时返回空响应体的 502 Bad Gateway，难以定位真实故障。 新增 _webhook_client_kwargs 辅助函数：目标为 loopback/内网地址时 trust_env=False 且不走代理直连；外部目标保持原有 proxy=Config.proxy 行为不变，完全向后兼容。与 app/tools 下 skland、kuro、miyoushe、 taygedo 等模块对特定请求使用 trust_env=False 的既有惯例一致。 同时让推送失败的异常信息附带 Webhook 名称，便于配置多个通知渠道时定位问题。
审查者指南通过按目标地址动态配置 httpx 代理参数，修复本地/内网 Webhook 被环境代理劫持并返回误导性 502 的问题，同时保持外部 Webhook 的原有代理兼容性，并在失败信息中补充 Webhook 名称。 本地和外部 Webhook 代理选择流程图flowchart TD
A[Webhook push] --> B["_webhook_client_kwargs(url)"]
B --> C{Local or private target?}
C -->|Yes| D["AsyncClient(timeout=10, trust_env=False)"]
C -->|No| E["AsyncClient(timeout=10, proxy=Config.proxy)"]
D --> F[client.post or client.get]
E --> F
F --> G{status_code == 200}
G -->|Yes| H[Log successful Webhook push]
G -->|No| I[raise Exception with Webhook name and HTTP status]
文件级变更
提示和命令与 Sourcery 互动
自定义你的使用体验访问你的控制面板以：
获取帮助Original review guide in EnglishReviewer's Guide通过按目标地址动态配置 httpx 代理参数，修复本地/内网 Webhook 被环境代理劫持并返回误导性 502 的问题，同时保持外部 Webhook 的原有代理兼容性，并在失败信息中补充 Webhook 名称。 Flow diagram for local and external Webhook proxy selectionflowchart TD
A[Webhook push] --> B["_webhook_client_kwargs(url)"]
B --> C{Local or private target?}
C -->|Yes| D["AsyncClient(timeout=10, trust_env=False)"]
C -->|No| E["AsyncClient(timeout=10, proxy=Config.proxy)"]
D --> F[client.post or client.get]
E --> F
F --> G{status_code == 200}
G -->|Yes| H[Log successful Webhook push]
G -->|No| I[raise Exception with Webhook name and HTTP status]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
你好——我发现了 1 个问题
AI Agent 提示词
请处理本次代码审查中的评论：
## 单独评论
### 评论 1
<location path="app/services/notification.py" line_range="311-319" />
<code_context>
- async with httpx.AsyncClient(proxy=Config.proxy, timeout=10) as client:
+ url = webhook.get("Data", "Url")
+
+ async with httpx.AsyncClient(**_webhook_client_kwargs(url)) as client:
if webhook.get("Data", "Method") == "POST":
if isinstance(data, dict):
</code_context>
<issue_to_address>
**issue (bug_risk):** 网络连接失败、超时或 DNS 解析失败时，`client.post()`/`client.get()` 直接抛出 httpx 异常，不会附带 Webhook 名称；因此多个渠道配置下，最需要定位的本地目标连接拒绝错误仍无法判断来自哪个 Webhook。
**Triggers:** 当 Webhook 目标不可达、连接被拒绝或请求超时时。
**Suggested fix:** 捕获 httpx 的请求异常并在重新抛出时加入 `webhook.get('Info', 'Name')`，同时保留原异常作为 cause。
</issue_to_address>Sourcery 评估
需要人工审查。 请先处理 1 个待解决的问题；此外，此更改通过禁用已配置的代理和环境代理设置，改变了所有 localhost 或私有 IP Webhook 的网络信任边界。如果该策略不正确，Webhook 负载可能会被直接发送到非预期的内部目标，或绕过必要的监控/控制路径；回滚可以阻止后续请求，但无法撤回已经传输的数据。
阻塞性问题：app/services/notification.py:319
请帮助我变得更有用！请对每条评论点击 👍 或 👎，我会利用这些反馈来改进审查结果。
Original comment in English
Hey - I've found 1 issue
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path="app/services/notification.py" line_range="311-319" />
<code_context>
- async with httpx.AsyncClient(proxy=Config.proxy, timeout=10) as client:
+ url = webhook.get("Data", "Url")
+
+ async with httpx.AsyncClient(**_webhook_client_kwargs(url)) as client:
if webhook.get("Data", "Method") == "POST":
if isinstance(data, dict):
</code_context>
<issue_to_address>
**issue (bug_risk):** 网络连接失败、超时或 DNS 解析失败时，`client.post()`/`client.get()` 直接抛出 httpx 异常，不会附带 Webhook 名称；因此多个渠道配置下，最需要定位的本地目标连接拒绝错误仍无法判断来自哪个 Webhook。
**Triggers:** 当 Webhook 目标不可达、连接被拒绝或请求超时时。
**Suggested fix:** 捕获 httpx 的请求异常并在重新抛出时加入 `webhook.get('Info', 'Name')`，同时保留原异常作为 cause。
</issue_to_address>Sourcery assessment
Needs a human reviewer. 1 finding to address first, and this changes the network trust boundary for every localhost or private-IP webhook by disabling the configured proxy and environment proxy settings. If that policy is wrong, webhook payloads can be sent directly to an unintended internal destination or bypass a required monitoring/control path; reverting stops future requests but cannot undo data already transmitted.
Blocking findings: app/services/notification.py:319
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+311
to
319
| async with httpx.AsyncClient(**_webhook_client_kwargs(url)) as client: | ||
| if webhook.get("Data", "Method") == "POST": | ||
| if isinstance(data, dict): | ||
| response = await client.post( | ||
| url=webhook.get("Data", "Url"), json=data, headers=headers | ||
| ) | ||
| response = await client.post(url=url, json=data, headers=headers) | ||
| elif isinstance(data, str): | ||
| response = await client.post( | ||
| url=webhook.get("Data", "Url"), content=data, headers=headers | ||
| ) | ||
| response = await client.post(url=url, content=data, headers=headers) | ||
| elif webhook.get("Data", "Method") == "GET": | ||
| if isinstance(data, dict): | ||
| # Flatten params to ensure all values are str or list of str |
There was a problem hiding this comment.
issue (bug_risk): 网络连接失败、超时或 DNS 解析失败时，client.post()/client.get() 直接抛出 httpx 异常，不会附带 Webhook 名称；因此多个渠道配置下，最需要定位的本地目标连接拒绝错误仍无法判断来自哪个 Webhook。
Triggers: 当 Webhook 目标不可达、连接被拒绝或请求超时时。
Suggested fix: 捕获 httpx 的请求异常并在重新抛出时加入 webhook.get('Info', 'Name')，同时保留原异常作为 cause。
Original comment in English
issue (bug_risk): 网络连接失败、超时或 DNS 解析失败时，client.post()/client.get() 直接抛出 httpx 异常，不会附带 Webhook 名称；因此多个渠道配置下，最需要定位的本地目标连接拒绝错误仍无法判断来自哪个 Webhook。
Triggers: 当 Webhook 目标不可达、连接被拒绝或请求超时时。
Suggested fix: 捕获 httpx 的请求异常并在重新抛出时加入 webhook.get('Info', 'Name')，同时保留原异常作为 cause。
Contributor
|
这个问题看着像是你代理软件没有配置好，此外我认为将localhost全部替换为127.0.0.1可以解决本机连接劫持的问题？ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
问题描述
当自定义 Webhook 通知的目标是本机或内网服务（例如本机的消息推送桥接服务）时，如果运行环境中存在代理环境变量（
HTTP_PROXY/HTTPS_PROXY等，使用 Clash 等系统代理的场景下较常见），推送请求会被代理劫持转发。代理无法连接目标时会返回空响应体的
HTTP/1.1 502 Bad Gateway，日志与前端表现为：由于状态码 502 且响应体为空，用户很难判断到底是推送目标本身不可达，还是请求被代理截走了，排查成本较高。本人实际遇到了这个问题：本机推送接收端未运行，本应报"连接被拒绝"，实际却收到了来自代理的 502。
根因分析
Notification.WebhookPush通过httpx.AsyncClient(proxy=Config.proxy, timeout=10)发送请求。httpx 默认trust_env=True——即使显式传入proxy=None，仍会读取进程环境变量中的代理设置，导致发往localhost/ 内网地址的请求经由系统代理转发。修复方案
新增
_webhook_client_kwargs(url)辅助函数，按目标地址区分处理：localhost主机名、RFC1918 私网等）：trust_env=False且不使用代理，直连目标；proxy=Config.proxy+ 默认trust_env），完全向后兼容。这与代码库中既有惯例一致——
app/tools/skland.py、app/tools/kuro.py、app/tools/miyoushe.py、app/tools/taygedo.py等模块已对特定请求使用trust_env=False。另外，推送失败的异常信息现在会附带 Webhook 名称（如
[HermesQQ推送] HTTP 502: ...），方便配置了多个通知渠道时快速定位是哪个渠道出了问题。自测情况
HTTP_PROXY环境变量：修复后本地 Webhook 推送直连成功；修复前同场景得到的是代理返回的 502Config.proxy，行为与修复前一致localhost主机名、127.0.0.1、内网 IP 时均正确判定为本地直连python -m py_compile通过以上是我在排查自己环境问题时定位到的根因与修复，已在本机稳定运行。如有考虑不周之处，恳请各位开发者指正，我会及时跟进调整。感谢团队维护这么棒的开源项目！
Sourcery 摘要
使自定义 Webhook 传送能够直接访问本地和私有网络目标，同时保留对外部目标的代理支持。
错误修复：
增强功能：
Original summary in English
Summary by Sourcery
Make custom Webhook delivery route local and private-network targets directly while retaining proxy support for external destinations.
Bug Fixes:
Enhancements: