Jakub Zych
7923fe86c7
feat(06-04): implement dial-time SSRF-guarded Fetch
...
- AllowHosts exact/dotted-suffix and PublicOnly modes, https-only
- Private/reserved IP check at net.Dialer.Control, no redirects
- Streaming io.LimitReader byte cap and typed failure reasons
2026-09-19 19:02:12 +02:00
Jakub Zych
bae9de8788
test(06-04): add failing tests for SSRF-guarded Fetch
...
- Cover host allow-list, dotted-suffix bypass, dial-time private IP
- Cover no-follow redirects, streaming byte cap, and D-14 config defaults
2026-09-19 19:00:01 +02:00
Jakub Zych
d3630e7de0
feat(06-04): implement private/reserved IP classification table
...
- Port PHP PRIVATE_V4_CIDRS and PRIVATE_V6_PREFIXES onto netip.Prefix
- Fail closed on invalid addresses; Unmap remains the caller's job
2026-09-19 18:57:44 +02:00
Jakub Zych
f7e7ca7fa3
test(06-04): add failing test for private/reserved IP table
...
- Table-driven cases port PHP PRIVATE_V4_CIDRS/PRIVATE_V6_PREFIXES
- Document Unmap() as the caller responsibility for v4-mapped literals
2026-09-19 18:57:18 +02:00
