Finding
validate_fetch_url() (line 245) resolves the host and checks the IPs then discards them, and the caller's reqwest client (built at search.rs:53 with no resolve override) does an independent DNS lookup at connect time, so an attacker-controlled indexer domain resolving public-at-validation then private/loopback-at-connect bypasses the SSRF guard on the live torznab/newznab/cardigann download path.
Evidence
crates/zetesis/src/client/mod.rs:245. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).
Why this matters
An attacker-controlled indexer domain can pass IP validation then resolve to a private/loopback address at connect time, letting a malicious indexer reach internal network services through harmonia's own SSRF-guarded fetcher.
Desired correction
Pin the validated IP into the request via reqwest's .resolve()/custom resolver (or a custom connector that re-checks the connected peer address against the disallow list); paroche/net_validate.rs's own WARNING already prescribes exactly this for any real fetcher.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.
Finding
validate_fetch_url() (line 245) resolves the host and checks the IPs then discards them, and the caller's reqwest client (built at search.rs:53 with no resolve override) does an independent DNS lookup at connect time, so an attacker-controlled indexer domain resolving public-at-validation then private/loopback-at-connect bypasses the SSRF guard on the live torznab/newznab/cardigann download path.
Evidence
crates/zetesis/src/client/mod.rs:245. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).Why this matters
An attacker-controlled indexer domain can pass IP validation then resolve to a private/loopback address at connect time, letting a malicious indexer reach internal network services through harmonia's own SSRF-guarded fetcher.
Desired correction
Pin the validated IP into the request via reqwest's .resolve()/custom resolver (or a custom connector that re-checks the connected peer address against the disallow list); paroche/net_validate.rs's own WARNING already prescribes exactly this for any real fetcher.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.