Skip to content

v0.3.3 - Built-in Generic Fetch Hardening & DNS SSRF Guard

Latest
Latest

Choose a tag to compare

View all tags
@A3Boy A3Boy released this 03 Sep 03:08
· 8 commits to main since this release
v0.3.3
29a0886

Security & Hardening

  • DNS Resolution & Rebinding SSRF Guard: Expanded \ etch-security.ts\ to resolve all A and AAAA DNS records prior to connection and across redirects, strictly blocking any host resolving to private/loopback/cloud metadata IP spaces.
  • Embedded Userinfo Rejection: Explicitly rejects URLs containing embedded credentials (\user:password@host) with \WEB_INVALID_URL.
  • 100% Local Defuddle Extraction: Enforced \useAsync: false\ during Defuddle parsing to strictly guarantee zero third-party external API calls (e.g. FxTwitter).
  • Explicit Timeout Enforcement: Added per-attempt timeout budgeting (\DEFAULT_GENERIC_FETCH_TIMEOUT_MS) and accurate \WEB_TIMEOUT\ classification in Generic Fetch.
  • Full Test Matrix: Added unit test coverage for DNS rebinding/resolution SSRF, userinfo rejection, and timeout budgeting (303/303 tests passing).
Assets 2
Loading