Update teams sink validation to accept post-2026 webhook hosts

[JohnBlackwell]

https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook?tabs=dotnet

Will allow new MS teams webhooks to be used in addtion to legacy ones. Introduces new helper function to avoid creating additional regex expressions.

Test environment: https://console.your-env.onplural.sh/

Tested with local dev env with the following urls:

Pass

https://environment.api.powerplatform.com:443/powerautomate/automations/direct/workflows/abc123/triggers/manual/paths/invoke?api-version=1&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=test
https://prod-01.westus.logic.azure.com:443/workflows/abc123/triggers/manual/paths/invoke?api-version=2016-10-01&sig=test
https://make.powerautomate.com/workflows/abc123/triggers/manual/paths/invoke?sig=test
https://outlook.office.com/webhook/abc123/IncomingWebhook/test
https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX

Fail

http://environment.api.powerplatform.com/workflows/abc123
https://example.com/workflows/abc123
https://not-slack.example.com/services/test
not-a-url

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[soffi-ai]

Soffi AI Summary

This PR updates the Microsoft Teams webhook URL validation logic in the notification sink configuration to support post-2026 Microsoft webhook hosts. Microsoft is migrating away from the legacy office.com/office365.com Office 365 connector webhook format toward Power Automate and Power Platform URLs, so the old regex-based approach (which only matched office in the hostname) would have broken for users creating new Teams notification sinks after the migration.

The fix extracts the URL-matching logic into a dedicated notificationSinkUrl.ts module, replacing a simple regex with an explicit allowlist of valid HTTPS hostnames for both Slack (slack.com, slack-gov.com) and Teams (office.com, office365.com, powerautomate.com, powerplatform.com, logic.azure.com). The new implementation uses the browser's URL parser for reliable hostname extraction, guards against URL spoofing attacks (userinfo and suffix spoofing, invalid ports), and preserves Slack Government Cloud support that was previously missing. A unit test suite covers all these cases.

Changes

Teams notification sink webhook URL support

• Replaced the legacy regex-based Teams webhook host check (which only matched 'office' in the hostname) with an explicit allowlist covering the new post-2026 Microsoft webhook hosts: powerautomate.com, powerplatform.com, and logic.azure.com, in addition to the legacy office.com/office365.com domains. Extracted the matching logic into a new notificationSinkUrl.ts helper and updated UpsertNotificationSinkModal to use it. (51093e0)
• Added malformed URL handling to the new matchesWebhookHost helper, using the browser's URL parser to safely extract hostnames and reject invalid or non-HTTPS URLs, protecting against userinfo and suffix hostname spoofing attacks. (f6f3cb7)
• Extended the Slack hostname allowlist to include slack-gov.com, restoring support for Slack Government Cloud webhooks that was absent from the original regex. Added a comprehensive unit test suite (notificationSinkUrl.test.ts) covering standard Slack, GovSlack, spoofing attacks, and invalid port scenarios. (86a3d73)

---

Updated: 2026-09-04 16:43 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

Updates notification sink URL validation to support current Microsoft Teams webhook domains while restricting Slack and Teams URLs to HTTPS on approved hosts.

• Replaces permissive hostname regexes with exact-domain and subdomain matching.
• Handles malformed URLs, including invalid ports, as validation failures instead of render-time exceptions.
• Stabilizes edit-mode memoization dependencies.

Confidence Score: 5/5

The PR appears safe to merge; the previously reported invalid-port crash is fixed and no new actionable failures were identified.

The URL constructor is now guarded, so malformed HTTPS URLs such as those with out-of-range ports return false rather than crashing the notification sink modal. The previous finding was also manually resolved.

Important Files Changed

Filename	Overview
js/console/src/components/settings/notifications/sinks/UpsertNotificationSinkModal.tsx	Adds reusable HTTPS webhook-host validation and safely handles URL parsing failures; no actionable issues remain.

_{Reviews (2): Last reviewed commit: "catch malformed urls" | Re-trigger Greptile}

[JohnBlackwell]

@greptile

[JohnBlackwell]

plural review this

[plural-copilot]

Plural Summary

Final-head review found no actionable defects. The webhook classifier now parses HTTPS URLs before allowlist matching, preserves Slack/Teams mutation behavior, and the focused helper tests pass (5/5).

Mergeability Grade: A

A — merge-ready. The change replaces permissive string matching with exact or dot-delimited subdomain checks on parsed HTTPS hostnames, preventing the reviewed userinfo and suffix spoofing cases while retaining Slack Gov and the newly supported Teams host families. No correctness, security, TypeScript, or call-site regression was found.

Files changed (3)

Filename	Summary
js/console/src/components/settings/notifications/sinks/UpsertNotificationSinkModal.tsx	Uses the parsed URL classifier for sink-type inference while preserving create/edit state initialization and the existing type-specific mutation payload.
js/console/src/components/settings/notifications/sinks/notificationSinkUrl.ts	Adds HTTPS-only parsed hostname allowlisting for Slack, Slack Gov, and supported Teams webhook host families.
js/console/src/components/settings/notifications/sinks/notificationSinkUrl.test.ts	Adds focused coverage for standard and GovSlack URLs, userinfo/suffix hostname spoofing, and invalid out-of-range ports.

[JohnBlackwell]

plural review this

[michaeljguarino]

this validation shouldn't be on the frontend at all, it should be done server-side.