sneak
fc720bfeee
check / check (push) Successful in 2m28s
Add a blocked_networks config key: a list of CIDRs parsed with net/netip, added to (not replacing) the built-in SSRF blocklist. An invalid CIDR aborts startup naming the key and the offending value. Extend the built-in blocklist to CGNAT 100.64.0.0/10, IETF protocol assignments 192.0.0.0/24, benchmark 198.18.0.0/15, and NAT64 64:ff9b::/96, unmapping IPv4-mapped IPv6 so the IPv4 ranges are caught in both forms. Enforcement stays in the dial-time re-resolution (dialSSRFSafe), which now also consults the operator-supplied prefixes, so the DNS-rebinding window remains closed. Model: opus-4-8