- Shipped
- 25 ஆகஸ்ட், 2026 அன்று 4:13 PM UTC
- Author
- Kamo
- Commit
- ed29861
The member types the URL, so every request this issues is an SSRF primitive, and there is no egress NetworkPolicy and no forward proxy in this cluster -- Redis answers unauthenticated on 6379 and MinIO on 9000 with root credentials. The application guard is the control. Reuses PublicHostGuard and the DNS pin from SafeImageFetcher but does not reuse the class itself: it caps at 256KB and refuses redirects, and both are wrong for a website. Redirects are the one relaxation, walked by hand with every hop re-checked, because acme.com -> www -> https is three hops before any HTML exists. A hop may never downgrade https to http, and that rule is asserted directly rather than through a socket -- driven through MockWebServer it would pass on the TLS handshake failing and keep passing if the rule were deleted.