ssrf

package

v0.5.0 Latest Latest Go to latest Published: Jul 25, 2026 License: Apache-2.0 Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/aijustin/agentflow-go

Links

Open Source Insights

Documentation ¶

Overview ¶

Package ssrf provides Server-Side Request Forgery guards for URL-fetching tools.

Index ¶

func CheckResolvedAddrs(host string, addrs []net.IP) error
func CheckURLHost(rawURL string) error
func IsBlockedIP(ip net.IP) bool
func LookupAndCheck(host string) error
type ErrBlocked
- func (e ErrBlocked) Error() string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func CheckResolvedAddrs ¶

func CheckResolvedAddrs(host string, addrs []net.IP) error

CheckResolvedAddrs rejects a hostname when any resolved address is blocked.

func CheckURLHost ¶

func CheckURLHost(rawURL string) error

CheckURLHost validates a URL host literal IP (no DNS). Hostnames that are not literal IPs pass this check; callers that resolve DNS should also call CheckResolvedAddrs.

func IsBlockedIP ¶

func IsBlockedIP(ip net.IP) bool

IsBlockedIP reports whether ip is in a private, link-local, CGNAT, or unspecified range that must not be fetched. Loopback is allowed for local development (matching grok-build web_fetch policy).

func LookupAndCheck ¶

func LookupAndCheck(host string) error

LookupAndCheck resolves host and rejects blocked addresses.

Types ¶

type ErrBlocked ¶

type ErrBlocked struct {
	Host string
	IP   net.IP
}

ErrBlocked is returned when a host or resolved address is in a blocked range.

func (ErrBlocked) Error ¶

func (e ErrBlocked) Error() string

Source Files ¶

View all Source files

ssrf.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL