Crawl4AI sent webhooks to caller-supplied URLs without validating their destination. The repair validates each webhook destination immediately before sending and disables redirects.

@@ -0,0 +53,18 @@+            for attempt in range(self.max_attempts):+                try:+                    logger.info(+                        f"Sending webhook (attempt {attempt + 1}/{self.max_attempts}) to {webhook_url}"+                    )++                    response = await client.post(+                        webhook_url,+                        json=payload,+                        headers=merged_headers

+                    )++                    # Success or client error (don't retry client errors)+                    if response.status_code < 500:+                        if 200 <= response.status_code < 300:+                            logger.info(f"Webhook delivered successfully to {webhook_url}")+                            return True+                        else:

@@ -44,13 +44,17 @@          Returns:             bool: True if delivered successfully, False otherwise         """+        # SECURITY: Validate webhook URL at send time (defense-in-depth against SSRF)+        from utils import validate_webhook_url+        validate_webhook_url(webhook_url)+         default_headers = self.config.get("headers", {})         merged_headers = {**default_headers, **(headers or {})}

         merged_headers["Content-Type"] = "application/json" -        async with httpx.AsyncClient(timeout=self.timeout) as client:+        async with httpx.AsyncClient(timeout=self.timeout, follow_redirects=False) as client:             for attempt in range(self.max_attempts):                 try:                     logger.info(                         f"Sending webhook (attempt {attempt + 1}/{self.max_attempts}) to {webhook_url}"