Maurice 31239f3687 fix(ssrf): connect over every address a name resolves to, IPv4 first ...

The guard resolved a name to one address and pinned the socket to it. On a
dual-stack name whose AAAA came first that was an IPv6 many hosts cannot
reach on 443, and the request sat until the caller's timeout while the A
record would have answered at once. OIDC discovery, Dawarich, AirTrail, the
photo providers, a self-hosted router or Nominatim and the model endpoints
all ride this path.

The name is now resolved to every address it has, each one is checked, and
one blocked address blocks the name. The whole checked list goes to the
socket, IPv4 ahead of IPv6, where Node walks it itself and moves on after
its attempt timeout. Redirect hops do the same per hop. A caller that still
names one address gets exactly the old behaviour.

2026-09-20 13:54:31 +02:00

..

cappedFetch.test.ts

fix(server): the second pass over this branch's own fixes

2026-08-23 11:59:12 +02:00

ipv6.test.ts

v3.4.0 (#1540)

2026-07-18 22:13:52 +02:00

ssrf-dual-stack.test.ts

fix(ssrf): connect over every address a name resolves to, IPv4 first

2026-09-20 13:54:31 +02:00

ssrf-llm-timeout.test.ts

fix(llm-parse): one configurable ceiling for a model call, and undici honours it

2026-09-04 18:56:22 +02:00

ssrfGuard.test.ts

fix(ssrf): connect over every address a name resolves to, IPv4 first

2026-09-20 13:54:31 +02:00