Maurice aad99e1c30 fix(plugins): close the UDP + DNS egress hole in the network guard ...

The egress guard only wrapped fetch and net.Socket.connect, so TCP and
HTTP were contained but two channels stayed wide open: a plugin could
send data out over UDP (node:dgram) or tunnel it inside DNS queries
(dns.resolveTxt & friends) to any host it never declared. Neither goes
through net.Socket.connect, so the allowlist never saw them.

Wrap both now against the same declared-host allowlist:
- dgram send/connect: the explicit destination is allowlisted and
  private-IP-checked like a TCP connect (a null address keeps the
  connected/localhost default, which the connect wrapper already vetted).
- the dns resolver family (module fns, dns.promises, Resolver.prototype):
  a forward lookup for an undeclared name is refused, which kills DNS
  tunnelling even when no socket is ever opened.

A plugin with no declared egress now really has no way out.

2026-07-04 19:11:23 +02:00

..

e2e

feat(planner): public transit routing via Transitous (#1065)

2026-07-03 15:06:31 +02:00

fixtures

feat(import): selective GPX/KML element import and performance improvements

2026-04-18 01:28:37 +02:00

helpers

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

integration

feat(plugins): sandbox hardening — OS permission model, egress choke point, bound acting user, author signatures

2026-07-04 19:11:23 +02:00

unit

fix(plugins): close the UDP + DNS egress hole in the network guard

2026-07-04 19:11:23 +02:00

websocket

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

setup.ts

Add comprehensive backend test suite (#339)

2026-04-03 13:17:53 +02:00