sneak fc720bfeee feat: blocked_networks config and extended SSRF ranges (closes #67) ...

Add a blocked_networks config key: a list of CIDRs parsed with net/netip,
added to (not replacing) the built-in SSRF blocklist. An invalid CIDR
aborts startup naming the key and the offending value.

Extend the built-in blocklist to CGNAT 100.64.0.0/10, IETF protocol
assignments 192.0.0.0/24, benchmark 198.18.0.0/15, and NAT64 64:ff9b::/96,
unmapping IPv4-mapped IPv6 so the IPv4 ranges are caught in both forms.
Enforcement stays in the dial-time re-resolution (dialSSRFSafe), which now
also consults the operator-supplied prefixes, so the DNS-rebinding window
remains closed.

Model: opus-4-8

2026-09-21 19:11:01 +00:00

..

blocked_networks_internal_test.go

test: failing tests for blocked_networks config and extended SSRF ranges

2026-09-21 19:10:17 +00:00

fetch_internal_test.go

test: cover redirect SSRF and semaphore release in httpfetcher (closes #78)

2026-09-21 19:59:26 +02:00

httpfetcher_internal_test.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00

httpfetcher.go

feat: blocked_networks config and extended SSRF ranges (closes #67)

2026-09-21 19:11:01 +00:00

mock.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00