netguard

func GuardedDialContext ¶

func GuardedDialContext(timeout time.Duration) func(ctx context.Context, network, addr string) (net.Conn, error)

GuardedDialContext returns a DialContext that re-checks the resolved address at connection time, so a hostname cannot pass save-time validation and then be re-pointed at a private address (DNS rebinding).

func IsPrivateIP ¶

func IsPrivateIP(ip net.IP) bool

func ValidateHost ¶

func ValidateHost(host string) error

ValidateHost resolves a hostname and rejects it when any address is private/loopback/link-local/CGNAT.

func ValidateURL ¶

func ValidateURL(raw string, allowPrivate bool) error

ValidateURL rejects an http(s) destination that resolves to the server's own network. Callers decide whether the guard applies (allowPrivate=true short-circuits).