fix(url-guard): block root-dotted internal hosts - #85

Open

aiirvizionz wants to merge 1 commit into

profullstack:masterfrom

aiirvizionz:clientkit/block-root-dotted-internal-urls

aiirvizionz commented Jul 25, 2026

Contributor

Summary

strip trailing DNS root dots before checking URL hostnames against blocked internal hosts
block *.localhost hostnames in addition to bare localhost
add regression coverage for localhost., app.localhost., and metadata.google.internal.

Tests

pnpm --filter @aiornot/web test


          fix(url-guard): block root-dotted internal hosts

c158680

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet