From b0d703158faf60bede16690a8655984edad10e12 Mon Sep 17 00:00:00 2001 From: Echo Date: Sun, 15 Feb 2026 11:16:31 -0500 Subject: [PATCH] fix(mattermost): ignore wildcard bind hosts for slash callback URLs --- .../mattermost/src/mattermost/slash-commands.ts | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/extensions/mattermost/src/mattermost/slash-commands.ts b/extensions/mattermost/src/mattermost/slash-commands.ts index 252169e844b..7181b02b788 100644 --- a/extensions/mattermost/src/mattermost/slash-commands.ts +++ b/extensions/mattermost/src/mattermost/slash-commands.ts @@ -507,7 +507,22 @@ export function resolveCallbackUrl(params: { if (params.config.callbackUrl) { return params.config.callbackUrl; } - let host = params.gatewayHost || "localhost"; + + const isWildcardBindHost = (rawHost: string): boolean => { + const trimmed = rawHost.trim(); + if (!trimmed) return false; + const host = trimmed.startsWith("[") && trimmed.endsWith("]") ? trimmed.slice(1, -1) : trimmed; + + // NOTE: Wildcard listen hosts are valid bind addresses but are not routable callback + // destinations. Don't emit callback URLs like http://0.0.0.0:3015/... or http://[::]:3015/... + // when an operator sets gateway.customBindHost. + return host === "0.0.0.0" || host === "::" || host === "0:0:0:0:0:0:0:0" || host === "::0"; + }; + + let host = + params.gatewayHost && !isWildcardBindHost(params.gatewayHost) + ? params.gatewayHost + : "localhost"; const path = normalizeCallbackPath(params.config.callbackPath); // Bracket IPv6 literals so the URL is valid: http://[::1]:3015/...