Enhance metadata URI validation

[gabmontes]

This pull request strengthens the IP address validation logic in Explorer.MetadataURIValidator to provide more robust protection against requests to private, reserved, and special-use IP ranges, especially for IPv6 and IPv6-mapped IPv4 addresses. It also introduces comprehensive tests to ensure the validator correctly blocks or allows various types of addresses.

Improvements to IP address validation:

• Expanded the blacklist in @reserved_ranges to include several important IPv6 ranges, such as loopback, unique local, link-local, documentation, and discard prefixes, as well as IPv6-mapped IPv4 and translated address spaces.
• Enhanced the allowed_ip?/1 logic to detect and block IPv6-mapped IPv4 addresses by extracting and checking the embedded IPv4 address against the blacklist, providing defense-in-depth against bypass attempts.
• Added a helper function extract_ipv4_from_mapped/1 to correctly parse and handle IPv6-mapped IPv4 addresses.
• Imported the Bitwise module to support bitwise operations needed for IPv6 address parsing.

Testing improvements:

• Added a new test module metadata_uri_validator_test.exs with extensive tests covering IPv4, native IPv6, and IPv6-mapped IPv4 addresses, ensuring the validator blocks all reserved and private ranges and allows valid public addresses. Tests also cover invalid URIs and disallowed protocols.

Checklist for your Pull Request (PR)

• If I added new functionality, I added tests covering it.
• If I fixed a bug, I added a regression test to prevent the bug from silently reappearing again.
• I checked whether I should update the docs and did so by submitting a PR to docs repository.
• If I added/changed/removed ENV var, I submitted a PR to docs repository to update the list of env vars and I updated the version to master in the Version column. If I removed variable, I added it to Deprecated ENV Variables page. After merging docs PR, changes will be reflected in these pages.
• If I added new DB indices, I checked, that they are not redundant, with PGHero or other tools.
• If I added/removed chain type, I modified the Github CI matrix and PR labels accordingly.

[gabmontes]

Explorer tests fail randomly. A fix is in the works in #54.

[Copilot]

Pull request overview

This PR hardens Explorer.MetadataURIValidator to reduce SSRF risk by expanding the reserved/private IP CIDR blacklist (notably for IPv6) and adding ExUnit coverage for IPv4, IPv6, and IPv6-mapped IPv4 inputs.

Changes:

• Expanded @reserved_ranges with multiple IPv6 special-use CIDRs and added IPv6-mapped IPv4 handling.
• Updated allowed_ip?/1 to perform additional checks for IPv6-mapped IPv4 addresses.
• Added a new test module covering blocked/allowed hosts and invalid URI/protocol cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
apps/explorer/lib/explorer/metadata_uri_validator.ex	Extends reserved CIDR blacklist and adds IPv6-mapped IPv4 extraction/check logic.
apps/explorer/test/explorer/metadata_uri_validator_test.exs	Adds a dedicated test suite validating blacklisting behavior across IP formats and URI validation errors.

Comments suppressed due to low confidence (1)

apps/explorer/test/explorer/metadata_uri_validator_test.exs:15

• setup/0 overwrites Application env for :indexer, Indexer.Fetcher.TokenInstance.Helper but never restores the previous value. This can leak configuration into other tests (especially when tests run concurrently); capture the old config and restore it in on_exit/1 (and consider avoiding persistent_term cache keys shared across the suite).

    # Ensure the required config is set for tests
    Application.put_env(:indexer, Indexer.Fetcher.TokenInstance.Helper,
      cidr_blacklist: [],
      allowed_uri_protocols: ["http", "https"],
      host_filtering_enabled?: true
    )

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[ArturDolzan]

uACK