Documentation
¶
Overview ¶
Package netutil provides network helpers, including SSRF-safe validation of user-supplied integration and outbound URLs.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SanitizeLogValue ¶
SanitizeLogValue strips line breaks from remote-derived values before they reach structured logs, so a crafted value cannot forge additional log entries.
func SanitizeSensitiveText ¶
SanitizeSensitiveText redacts credentials and common secret query parameters from error strings before they are logged or returned through API responses. Line breaks are also removed so the result is safe to log.
func ValidateIntegrationURL ¶
ValidateIntegrationURL checks admin-initiated integration test URLs (Prowlarr, Kavita, etc.). Private and loopback addresses are allowed — homelab services commonly run at http://192.168.x.x:port or http://localhost:port.
func ValidateOutboundURL ¶
ValidateOutboundURL checks that rawURL is a safe http(s) target for server-side requests. It rejects loopback, private, link-local, and metadata addresses (see LIBRARR_INSECURE_ALLOW_PRIVATE_URLS for the LAN-mirror escape hatch).
func ValidateSameOriginHTTPURL ¶
ValidateSameOriginHTTPURL parses rawURL and verifies that it has the same normalized host and effective port as allowedOrigin. It is intended for integration-owned URLs, such as Prowlarr download links, where the server may legitimately be private or loopback but redirects must not escape the configured origin.
Types ¶
This section is empty.
Source Files