Harden webhook API input

lib/pleroma/web/admin_api/controllers/webhook_controller.ex

@@ -40,14 +40,14 @@ defmodule Pleroma.Web.AdminAPI.WebhookController do
   end
 
   def create(%{body_params: params} = conn, _) do
-    with {:ok, webhook} <- Webhook.create(params) do
+    with {:ok, webhook} <- Webhook.create(webhook_params(params)) do
       render(conn, "show.json", webhook: webhook)
     end
   end
 
   def update(%{body_params: params} = conn, %{id: id}) do
     with %Webhook{internal: false} = webhook <- Webhook.get(id),
-         {:ok, webhook} <- Webhook.update(webhook, params) do
+         {:ok, webhook} <- Webhook.update(webhook, webhook_params(params)) do
       render(conn, "show.json", webhook: webhook)
     else
       %Webhook{internal: true} -> {:error, :forbidden}
@@ -94,4 +94,8 @@ defmodule Pleroma.Web.AdminAPI.WebhookController do
       nil -> {:error, :not_found}
     end
   end
+
+  defp webhook_params(params) do
+    Map.drop(params, [:internal, "internal"])
+  end
 end

lib/pleroma/web/api_spec/operations/admin/webhook_operation.ex

@@ -58,9 +58,10 @@ defmodule Pleroma.Web.ApiSpec.Admin.WebhookOperation do
             required: [:url, :events],
             properties: %{
               url: %Schema{type: :string, format: :uri},
-              events: event_type(),
+              events: event_type(min_items: 1),
               enabled: %Schema{type: :boolean}
-            }
+            },
+            additionalProperties: false
           }
         ),
       responses: %{
@@ -84,9 +85,10 @@ defmodule Pleroma.Web.ApiSpec.Admin.WebhookOperation do
             type: :object,
             properties: %{
               url: %Schema{type: :string, format: :uri},
-              events: event_type(),
+              events: event_type(min_items: 1),
               enabled: %Schema{type: :boolean}
-            }
+            },
+            additionalProperties: false
           }
         ),
       responses: %{
@@ -180,8 +182,8 @@ defmodule Pleroma.Web.ApiSpec.Admin.WebhookOperation do
     }
   end
 
-  defp event_type do
-    %Schema{
+  defp event_type(opts \\ []) do
+    schema = %Schema{
       type: :array,
       items: %Schema{
         title: "Event",
@@ -190,6 +192,11 @@ defmodule Pleroma.Web.ApiSpec.Admin.WebhookOperation do
         enum: ["account.created", "report.created"]
       }
     }
+
+    case Keyword.fetch(opts, :min_items) do
+      {:ok, min_items} -> %{schema | minItems: min_items}
+      :error -> schema
+    end
   end
 
   defp id_param do