Alex Shnitman 13cb65d931 docs: document the SSRF guard's connect-time coverage limitations ...

The connect-time getaddrinfo guard added for redirect/rebinding SSRF covers
only the download subprocess: metadata extraction runs in the main process
(where a process-wide guard would reject the server's own HOST=0.0.0.0 bind),
and native curl_cffi/libcurl resolution used by --impersonate bypasses Python's
socket module. Record both in url_guard's docstring and at the extraction site
so the boundary is explicit; network isolation remains the backstop.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-21 07:41:01 +03:00

..

tests

fix: re-validate outbound connections at fetch time against internal hosts

2026-07-21 06:55:29 +03:00

bg_tasks.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

dl_formats.py

fix: harden download lifecycle, subscriptions, and UI robustness

2026-07-12 08:08:14 +03:00

main.py

fix: enforce download-dir containment at the resolved-path chokepoint

2026-07-20 23:44:43 +03:00

state_store.py

fix: fsync parent dir after direct-write fallback for durability parity

2026-07-05 04:11:12 -07:00

subscriptions.py

fix: block SSRF via user-submitted URLs

2026-07-16 21:31:51 +03:00

url_guard.py

docs: document the SSRF guard's connect-time coverage limitations

2026-07-21 07:41:01 +03:00

ytdl.py

docs: document the SSRF guard's connect-time coverage limitations

2026-07-21 07:41:01 +03:00