Add NormalizeHostname helper; use it in TrustedHosts

Create helpers/net/NormalizeHostname.java (lowercase, strip trailing
dot, IDN via java.net.IDN) to give SSRF code a canonical hostname form.
Replace the inline normalization in TrustedHosts.isTrustedHostname with
a call to this helper.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: bitterpanda63

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/NormalizeHostname.java

@@ -0,0 +1,25 @@
+package dev.aikido.agent_api.helpers.net;
+
+import java.net.IDN;
+
+public final class NormalizeHostname {
+    private NormalizeHostname() {}
+
+    /**
+     * Canonicalizes a hostname for consistent comparison: lowercases, strips a
+     * trailing dot (FQDN form returned by some DNS resolvers), and converts
+     * Punycode labels to Unicode via IDN.
+     */
+    public static String normalize(String hostname) {
+        if (hostname == null || hostname.isEmpty()) {
+            return hostname;
+        }
+        String lower = hostname.toLowerCase();
+        String noDot = lower.endsWith(".") ? lower.substring(0, lower.length() - 1) : lower;
+        try {
+            return IDN.toUnicode(noDot);
+        } catch (Exception e) {
+            return noDot;
+        }
+    }
+}

agent_api/src/main/java/dev/aikido/agent_api/vulnerabilities/ssrf/imds/TrustedHosts.java

@@ -1,8 +1,7 @@
 package dev.aikido.agent_api.vulnerabilities.ssrf.imds;
 
+import dev.aikido.agent_api.helpers.net.NormalizeHostname;
 import java.util.Arrays;
-import java.util.HashSet;
-import java.util.Set;
 
 public final class TrustedHosts {
     private TrustedHosts() {}
@@ -13,10 +12,6 @@ private TrustedHosts() {}
 
     /** Checks if this hostname is trusted */
     public static boolean isTrustedHostname(String hostname) {
-        String normalized = hostname.toLowerCase();
-        if (normalized.endsWith(".")) {
-            normalized = normalized.substring(0, normalized.length() - 1);
-        }
-        return Arrays.asList(trustedHosts).contains(normalized);
+        return Arrays.asList(trustedHosts).contains(NormalizeHostname.normalize(hostname));
     }
 }

agent_api/src/test/java/helpers/net/NormalizeHostnameTest.java

@@ -0,0 +1,40 @@
+package helpers.net;
+
+import dev.aikido.agent_api.helpers.net.NormalizeHostname;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+class NormalizeHostnameTest {
+
+    @Test
+    void testNullAndEmpty() {
+        assertNull(NormalizeHostname.normalize(null));
+        assertEquals("", NormalizeHostname.normalize(""));
+    }
+
+    @Test
+    void testLowercases() {
+        assertEquals("example.com", NormalizeHostname.normalize("EXAMPLE.COM"));
+        assertEquals("metadata.google.internal", NormalizeHostname.normalize("METADATA.GOOGLE.INTERNAL"));
+    }
+
+    @Test
+    void testStripsTrailingDot() {
+        assertEquals("example.com", NormalizeHostname.normalize("example.com."));
+        assertEquals("metadata.google.internal", NormalizeHostname.normalize("metadata.google.internal."));
+        assertEquals("metadata.goog", NormalizeHostname.normalize("metadata.goog."));
+    }
+
+    @Test
+    void testStripsTrailingDotAndLowercases() {
+        assertEquals("metadata.google.internal", NormalizeHostname.normalize("METADATA.GOOGLE.INTERNAL."));
+    }
+
+    @Test
+    void testPlainHostnameUnchanged() {
+        assertEquals("example.com", NormalizeHostname.normalize("example.com"));
+        assertEquals("localhost", NormalizeHostname.normalize("localhost"));
+    }
+}