fix(voice-call): bound Twilio API hosts

vincentkoc · vincentkoc · commit 094c0d421faf · 2026-07-07T07:40:14.000+02:00
diff --git a/extensions/voice-call/src/providers/twilio-region.ts b/extensions/voice-call/src/providers/twilio-region.ts
@@ -8,10 +8,24 @@ const TWILIO_API_HOSTNAME_BY_REGION = {
   au1: "api.sydney.au1.twilio.com",
 } satisfies Record<TwilioRegion, string>;
 
+const TWILIO_API_HOSTNAMES = new Set(Object.values(TWILIO_API_HOSTNAME_BY_REGION));
+
+export function resolveTwilioApiHostname(region?: TwilioRegion): string {
+  return TWILIO_API_HOSTNAME_BY_REGION[region ?? "us1"];
+}
+
 export function resolveTwilioApiBaseUrl(params: {
   accountSid: string;
   region?: TwilioRegion;
 }): string {
-  const hostname = TWILIO_API_HOSTNAME_BY_REGION[params.region ?? "us1"];
+  const hostname = resolveTwilioApiHostname(params.region);
   return `https://${hostname}/2010-04-01/Accounts/${params.accountSid}`;
 }
+
+export function requireSupportedTwilioApiHostname(baseUrl: string): string {
+  const hostname = new URL(baseUrl).hostname;
+  if (!TWILIO_API_HOSTNAMES.has(hostname)) {
+    throw new Error(`Unsupported Twilio API hostname: ${hostname}`);
+  }
+  return hostname;
+}
diff --git a/extensions/voice-call/src/providers/twilio/api.test.ts b/extensions/voice-call/src/providers/twilio/api.test.ts
@@ -126,6 +126,19 @@ describe("twilioApiRequest", () => {
     expect(release).toHaveBeenCalledTimes(1);
   });
 
+  it("rejects unsupported API hosts before the SSRF guard", async () => {
+    await expect(
+      twilioApiRequest({
+        baseUrl: "https://metadata.google.internal/2010-04-01/Accounts/AC123",
+        accountSid: "AC123",
+        authToken: "secret",
+        endpoint: "/Calls.json",
+        body: {},
+      }),
+    ).rejects.toThrow("Unsupported Twilio API hostname: metadata.google.internal");
+    expect(fetchWithSsrFGuardMock).not.toHaveBeenCalled();
+  });
+
   it("maps AU1 to Twilio's Sydney regional hostname", () => {
     expect(resolveTwilioApiBaseUrl({ accountSid: "AC123", region: "au1" })).toBe(
       "https://api.sydney.au1.twilio.com/2010-04-01/Accounts/AC123",
diff --git a/extensions/voice-call/src/providers/twilio/api.ts b/extensions/voice-call/src/providers/twilio/api.ts
@@ -5,6 +5,7 @@ import {
   readProviderErrorResponseSnippet,
   readProviderJsonResponseText,
 } from "../shared/response-body.js";
+import { requireSupportedTwilioApiHostname } from "../twilio-region.js";
 
 // Guarded Twilio REST API client helpers.
 
@@ -74,6 +75,7 @@ export async function twilioApiRequest<T = unknown>(params: {
         }, new URLSearchParams());
 
   const requestUrl = `${params.baseUrl}${params.endpoint}`;
+  const allowedHostname = requireSupportedTwilioApiHostname(params.baseUrl);
   const { response, release } = await fetchWithSsrFGuard({
     url: requestUrl,
     init: {
@@ -84,7 +86,7 @@ export async function twilioApiRequest<T = unknown>(params: {
       },
       body: bodyParams,
     },
-    policy: { allowedHostnames: [new URL(requestUrl).hostname] },
+    policy: { allowedHostnames: [allowedHostname] },
     timeoutMs: TWILIO_API_TIMEOUT_MS,
     auditContext: "voice-call.twilio.api",
   });
