sneak 624639c1ec test: cover redirect SSRF and semaphore release in httpfetcher (closes #78) ...

Adds httptest-server tests for the risk-bearing paths that only had
helper-level coverage: the CheckRedirect validator (a 302 to a
link-local address is refused with ErrSSRFBlocked and never dialed,
while a redirect chain and a redirect to a public target still
succeed), per-host semaphore release on the error, full-read-close and
partial-read-close paths (proven by saturating a one-slot host), the
MaxResponseSize limit through Fetch, non-2xx and disallowed
content-type rejection, and ssrfSafeDialer's block of a private target.

The upstream host is a TEST-NET-1 literal (192.0.2.10) that isPrivateIP
treats as public and that resolves with no DNS, with a recording dialer
routing it to the local server so the real SSRF checks still run. Full
DNS-rebinding simulation is out of scope; the dial-time private-target
block that closes that window is tested directly.

Model: opus-4-8

2026-09-21 17:28:55 +00:00

..

fetch_internal_test.go

test: cover redirect SSRF and semaphore release in httpfetcher (closes #78)

2026-09-21 17:28:55 +00:00

httpfetcher_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

mock.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00