fix(06-13): full IANA special-use SSRF tables and reject zoned dial targets

2026-09-21 19:44:51 +02:00
parent 4bad1a43a2
commit b1079ab8a4
4 changed files with 47 additions and 18 deletions
--- a/fetchguard/fetch.go
+++ b/fetchguard/fetch.go
@@ -155,6 +155,9 @@ func dialControl(policy Policy) func(network, address string, c syscall.RawConn)
 		if err != nil {
 			return fmt.Errorf("fetchguard: unparseable dial address %q: %w", host, err)
 		}
+		if addr.Zone() != "" {
+			return errPrivateIP
+		}
 		addr = addr.Unmap()
 		if isReservedOrPrivate(addr) {
 			return errPrivateIP