sneak
eb75b92fb0
check / check (push) Failing after 1s
Adds httptest-server tests for the risk-bearing paths that only had helper-level coverage: the CheckRedirect validator (a 302 to a link-local address is refused with ErrSSRFBlocked and never dialed, while a redirect chain and a redirect to a public target still succeed), per-host semaphore release on the error, full-read-close, and partial-read-close paths (proven by saturating a one-slot host), the MaxResponseSize limit end-to-end through Fetch, non-2xx and disallowed content-type rejection, and ssrfSafeDialer's dial-time block of a private target. To reach a loopback test server while the real SSRF checks run, the upstream host is a TEST-NET-1 literal (192.0.2.10) that isPrivateIP treats as public and that resolves with no DNS, and a recording dialer routes it to the server. Full DNS-rebinding simulation is documented as out of scope; the dial-time private-target block that closes that window is tested directly. model: claude-opus-4-8