rcourtman b6f7091952 fix: block SSRF bypass through HTTP proxy in restricted outbound client ... NewRestrictedOutboundHTTPClient validates target IPs via a custom DialContext, but when an HTTP proxy is configured (HTTP_PROXY env var) DialContext only validates the proxy's address — the actual target host is never checked. This allows requests to cloud metadata service addresses (169.254.169.254) and other blocked IPs through the proxy. Add a restrictedRoundTripper wrapper that validates the request URL hostname against resolvePermittedOutboundIP before forwarding. This provides defense-in-depth that works regardless of proxy configuration, while the existing DialContext guard continues to prevent DNS rebinding for direct connections.		2026-06-26 13:05:23 +01:00
..
httpurl.go	Allow insecure dev HTTP agent runtime URLs	2026-04-23 13:48:54 +01:00
outbound_http.go	fix: block SSRF bypass through HTTP proxy in restricted outbound client	2026-06-26 13:05:23 +01:00
outbound_http_test.go	fix: block SSRF bypass through HTTP proxy in restricted outbound client	2026-06-26 13:05:23 +01:00
websocket_origin.go	Allow insecure dev HTTP agent runtime URLs	2026-04-23 13:48:54 +01:00