Function renderRequestAllowed

cli/plugins/webfetch_render.go:391–406

── SSRF policy for in-page sub-requests ──────────────────────────── renderRequestAllowed enforces the SSRF policy on a sub-request issued by the rendered page. Non-HTTP schemes (data:, blob:, about:) never leave the renderer and are allowed. For HTTP(S), the same upfront validation as the static pa

(rawURL string)

// hostnames are additionally resolved and range-checked, since Chromium
// dials by itself and ssrfDialControl cannot intercept it.
func renderRequestAllowed(rawURL string) bool {
	parsed, err := url.Parse(rawURL)
	if err != nil {
		return false
	}
	if parsed.Scheme != "http" && parsed.Scheme != "https" {
		return true
	}
	if _, err := validateWebTarget(rawURL); err != nil {
		return false
	}
	if !webBlockPrivate() {
		return true
	}
	return resolvedHostAllowed(parsed.Hostname())
}

// hostVerdicts memoizes resolve-and-check results per hostname: an SPA
// can fire hundreds of sub-requests against the same handful of hosts and