9qeklajc 34ffc8f7b0 Validate destinations of pre-auth image URL fetches ...

Cost estimation fetches caller-supplied image URLs before any credential is
checked, so the node could be aimed at loopback, link-local, and private
addresses. Restrict the fetch to globally reachable addresses (RFC 6890),
resolve DNS once and validate every returned address, and rewrite plain HTTP
to the validated address with the original Host header so a name cannot
rebind between the check and the connection. HTTPS keeps its hostname because
certificate validation already binds it. Cap the downloaded prefix and the
number of URLs one request may fetch.

2026-09-04 02:08:30 +02:00

..

__init__.py

small fixes

2025-11-11 15:42:26 +01:00

cost_calculation.py

feat(payment): keep the upstream reported USD cost beside the billed one

2026-09-02 07:43:24 +02:00

helpers.py

Validate destinations of pre-auth image URL fetches

2026-09-04 02:08:30 +02:00

lnurl.py

fix: address review findings on cooldowns, melt sizing, and stream finalization

2026-08-26 23:15:40 +02:00

models.py

refactor(models): extract the deterministic USD builder from _row_to_model

2026-09-01 15:17:58 +02:00

price.py

fix(pricing): reject an exchange quote that underflows the sats price

2026-08-26 15:50:26 +02:00

rates.py

fix(pricing): a rate spelled as a boolean is not a rate

2026-08-26 15:44:29 +02:00

usage.py

revert: remove unrelated repository formatting

2026-07-26 20:12:12 +02:00