Add test cases to ensure actual IMDS requests are safe

Author: bitterpanda63

agent_api/src/test/java/vulnerabilities/ssrf/ResolverTest.java

@@ -27,6 +27,14 @@ void testResolvesToImdsIp_WithImdsIp() {
         assertEquals("169.254.169.254", Resolver.resolvesToImdsIp(resolvedIps, "example.com"));
     }
 
+    @Test
+    void testDoesntResolveToImdsIp_WithHostnameImdsIp() {
+        Set<String> resolvedIps = new HashSet<>();
+        resolvedIps.add("169.254.169.254"); // IMDS IP
+
+        assertNull(Resolver.resolvesToImdsIp(resolvedIps, " 169.254.169.254 "));
+    }
+
     @Test
     void testResolvesToImdsIp_WithMultipleResolvedIps_OneImdsIp() {
         Set<String> resolvedIps = new HashSet<>();

agent_api/src/test/java/vulnerabilities/ssrf/StoredSSRFDetectorTest.java

@@ -70,6 +70,13 @@ void run_WhenIpIsIpv6ImdsIp_ReturnsAttack() {
         assertNull(result.user);
     }
 
+    @Test
+    void run_WhenIpIsIpv6ImdsIp_ReturnsAttackNotWhenIpIsHostname() {
+        Attack result = detector.run("fd00:ec2::254", List.of("fd00:ec2::254"), "testOperation");
+        assertNull(result);
+    }
+
+
     @Test
     void run_WhenIpIsNotImdsIp_ReturnsNull() {
         Attack result = detector.run("test.example.com", List.of("192.168.1.1"), "testOperation");