sneak
624639c1ec
check / check (push) Failing after 1s
Adds httptest-server tests for the risk-bearing paths that only had helper-level coverage: the CheckRedirect validator (a 302 to a link-local address is refused with ErrSSRFBlocked and never dialed, while a redirect chain and a redirect to a public target still succeed), per-host semaphore release on the error, full-read-close and partial-read-close paths (proven by saturating a one-slot host), the MaxResponseSize limit through Fetch, non-2xx and disallowed content-type rejection, and ssrfSafeDialer's block of a private target. The upstream host is a TEST-NET-1 literal (192.0.2.10) that isPrivateIP treats as public and that resolves with no DNS, with a recording dialer routing it to the local server so the real SSRF checks still run. Full DNS-rebinding simulation is out of scope; the dial-time private-target block that closes that window is tested directly. Model: opus-4-8