9qeklajc 34ffc8f7b0 Validate destinations of pre-auth image URL fetches ...

Cost estimation fetches caller-supplied image URLs before any credential is
checked, so the node could be aimed at loopback, link-local, and private
addresses. Restrict the fetch to globally reachable addresses (RFC 6890),
resolve DNS once and validate every returned address, and rewrite plain HTTP
to the validated address with the original Host header so a name cannot
rebind between the check and the connection. HTTPS keeps its hostname because
certificate validation already binds it. Cap the downloaded prefix and the
number of URLs one request may fetch.

2026-09-04 02:08:30 +02:00

..

integration

harden cashu path

2026-09-04 01:35:43 +02:00

unit

Validate destinations of pre-auth image URL fetches

2026-09-04 02:08:30 +02:00

conftest.py

test: add return type annotations to cache fixtures for strict mypy

2026-08-17 23:26:52 +02:00

run_integration.py

dump wip stash

2025-08-06 20:31:55 -03:00