Function validateWebTarget

cli/plugins/web_ssrf_guard.go:71–102

validateWebTarget validates rawURL against the SSRF policy and returns a canonical, re-encoded URL string safe to hand to the HTTP client. Hostname targets are only checked for scheme/metadata here; their resolved IP is enforced at dial time by ssrfDialControl (rebinding-proof).

(rawURL string)

// targets are only checked for scheme/metadata here; their resolved IP is
// enforced at dial time by ssrfDialControl (rebinding-proof).
func validateWebTarget(rawURL string) (string, error) {
	parsed, err := url.Parse(strings.TrimSpace(rawURL))
	if err != nil {
		return "", fmt.Errorf("invalid URL: %w", err)
	}

	switch parsed.Scheme {
	case "http", "https":
		// allowed
	default:
		return "", fmt.Errorf("unsupported URL scheme %q (only http/https are allowed)", parsed.Scheme)
	}

	host := parsed.Hostname()
	if host == "" {
		return "", fmt.Errorf("missing host in URL")
	}

	if isMetadataHostname(host) {
		return "", fmt.Errorf("blocked cloud metadata hostname %q", host)
	}

	// A literal IP is checked immediately (no DNS needed). Hostnames are
	// enforced at dial time.
	if ip := net.ParseIP(host); ip != nil {
		if err := checkWebIP(ip, webBlockPrivate(), host); err != nil {
			return "", err
		}
	}

	return parsed.String(), nil
}

// ssrfDialControl is installed as net.Dialer.Control on the web transport. It
// runs after DNS resolution with the concrete address about to be dialed,