Task · GOB-0005

httpx SSRF: close the proxy-path DNS-rebinding residual

Status
To Do
Priority
medium
Labels
followup-v2, security, httpx
Updated
2026-08-14

Description

Migrated from followup.md §8 (v2 stream) at the 2026-08-14 tracker migration.

Scope this narrowly — the direct dial path is already fully guarded (confirmed 2026-06-22, and #96 separately closed the unspecified-address 0.0.0.0 / :: hole). httpx.checkDest is exact for IP-literal hosts and resolves-then-checks hostnames.

The residual is only reachable when an HTTP(S)_PROXY is configured: the proxy resolves the hostname, so a DNS-rebinding race between our check and the proxy’s resolution cannot be fully closed in-process. Closing it means pinning resolution or pushing egress policy to the proxy itself.

Worth doing only if a deployment actually uses a proxy. Note #128 for the adjacent trap: the sourceEgressCIDR guidance ignores the Portkey logs_export signed-URL S3 download, so tightening egress per the values comment stalls the logs loop — any egress-policy change here must not repeat that.

Acceptance Criteria

Definition of Done

References

View the source file on GitHub