[Wave 3] Medium — Security-contract fixes: SSRF #649

Wave 3 · 1 finding(s) in 1 fix package(s). Medium-severity findings that touch the security contract (exit codes, secrets, paths, provenance): do these before the rest of wave 3.

Findings

• CR-A10-017 (code, Medium) — approve/reject rebuild the webhook notifier from writable compliance_report.json with no key allowlist, so an output-dir writer sets url and allow_private_destinations (SSRF from the approver's host)
  severity Medium · reachability default · intent intended-but-harmful · confidence confirmed · independently confirmed · reproduced end to end
  Failure scenario. Whoever can write the training output directory plants a webhook_config. When the approver runs 'forgelm approve', the approver's workstation POSTs approval metadata to an internal admin endpoint reachable only from that network.
  Where. forgelm/cli/subcommands/_approve.py:284-317 (SimpleNamespace at :302), forgelm/webhook.py:69-83 (url read at :80), forgelm/webhook.py:132,146,154,172, forgelm/compliance.py:41-42
  Recommended fix. In the rebuild path accept only an allowlisted scalar subset, drop url/allow_private_destinations/tls_ca_bundle (or force allow_private False and the URL from url_env only), validate types, and add a test with a hostile manifest.

Done when

• Every finding above is fixed or closed with a reason (tick it here).
• Code fixes carry a test; doc fixes update the Turkish mirror in the same PR.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}