mirror of
https://github.com/alexta69/metube.git
synced 2026-09-21 13:35:01 +00:00
Alex Shnitman
de57484fc9
Scoping the connect-time allowance to the configured proxy kept the exception tied to loopback, so a proxy anywhere else internal — the common case of a socks5 or HTTP proxy on the LAN — was refused with "Refusing to connect to non-global address". The only workaround was ALLOW_PRIVATE_ADDRESSES, which switches the whole guard off, a far larger concession than the setup needs. The allowance was never really about loopback: it is about the operator having named this host:port as a proxy. Widen it to any address at a configured proxy endpoint and nothing is given away, because the match is on the configured host string rather than the resolved address — a hostile media URL that resolves to the proxy's address under another name gets no allowance, and one that names the proxy endpoint itself only reaches the proxy. Every other internal destination stays refused. Also log each configured proxy endpoint, so the next report of this shape can be diagnosed from the log rather than from the guard's source. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>