Problem

is_blocked_webhook_host in crates/librefang-types/src/scheduler.rs blocks only a subset of local/loopback targets. Missing:

• 0.0.0.0 (unspecified)
• Private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
• Hex IP: 0x7f000001
• Decimal IP: 2130706433
• IPv4-mapped IPv6: ::ffff:127.0.0.1, ::ffff:7f000001
• Octal IP: 0177.0.0.1

Additionally:

• CronDelivery::Webhook validate_delivery only checks scheme + length (scheduler.rs:668-678)
• update_job / set_delivery_targets skip validate_delivery_targets entirely (cron.rs:296-305, cron.rs:318-326)
• webhook_http_ok test accepts http://localhost:8080/hook (scheduler.rs:1262-1268)

Impact

Any cron job with CronDeliveryTarget::Webhook can target loopback, private, or cloud metadata endpoints.

Suggested fix

1. Use real URL/IP parser, normalize host
2. Block: loopback, unspecified, link-local, private, metadata IPs in all forms (hex, decimal, octal, IPv4-mapped IPv6)
3. Validate on both create AND update/set paths
4. Centralize validation for CronDeliveryTarget::Webhook and CronDelivery::Webhook
5. Fix tests to reject localhost

References

• Review of refaktor/dashboard4 PR identified this as blocker for UI blocklist port
• UI blocklist ported as UX-only feedback (not security boundary)