mudler-agentandEttore Di Giacinto 756b019ce4 [httpclient] validate redirect targets and pin dialed addresses for user URLs (#12853) ...

fix(httpclient): validate redirect targets and pin dialed addresses for user URLs

Clients that fetch user-supplied URLs followed redirects without checking
the target, so a public host could send them to a loopback, link-local
or private address. The host was also resolved twice, once to validate
it and once to connect, so a changing DNS answer could bypass the check.

Add httpclient.WithExternalOnly. It validates every redirect hop against
the external URL policy and, for the default transport, resolves the
host, refuses it if any address is non-public, and dials the validated
address. Environment proxies are not used for such clients.

Move the policy (ValidateExternalURL, IsPublicIP) into pkg/httpclient
so it can be used without an import cycle; pkg/utils keeps delegating
to it. IsPublicIP now also refuses 100.64.0.0/10, 0.0.0.0/8,
192.0.0.0/24, 198.18.0.0/15, 240.0.0.0/4, multicast, and NAT64
addresses that wrap a non-public IPv4 address.

Use the option for the base64, image, audio and video downloads, and
drop the video client's own per-hop check.

Assisted-by: Claude Code:claude-haiku-5-5

Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

2026-10-23 11:54:42 +02:00

..

client_test.go

fix(downloader): bound the wait for response headers so a wedged origin cannot hang an install forever (#11053)

2026-07-22 18:28:51 +02:00

client.go

[httpclient] validate redirect targets and pin dialed addresses for user URLs (#12853)

2026-10-23 11:54:42 +02:00

external_test.go

[httpclient] validate redirect targets and pin dialed addresses for user URLs (#12853)

2026-10-23 11:54:42 +02:00

external.go

[httpclient] validate redirect targets and pin dialed addresses for user URLs (#12853)

2026-10-23 11:54:42 +02:00