ExAthena.Net (ExAthena v0.17.0)

Network address classification for the web tools' SSRF guard.

When a run is confined, WebFetch refuses URLs whose host is (or resolves to) a loopback, private, link-local, or otherwise non-public address — so the agent can't reach localhost, internal services, or the cloud metadata endpoint (169.254.169.254).

Summary

Functions

blocked_host?(host)

Whether host (a hostname or IP literal) should be blocked as non-public.

private_ip?(arg)

Whether an :inet address tuple is loopback / private / link-local / non-public.

Functions

blocked_host?(host)

@spec blocked_host?(String.t()) :: boolean()

Whether host (a hostname or IP literal) should be blocked as non-public.

IP literals are classified directly; hostnames are resolved (A + AAAA) and blocked if any resolved address is non-public (defeats DNS-rebinding to an internal IP). A host that fails to resolve is not blocked here — the HTTP request simply fails downstream.

private_ip?(arg)

@spec private_ip?(:inet.ip_address()) :: boolean()

Whether an :inet address tuple is loopback / private / link-local / non-public.