fix(security): harden protocol-download SSRF guard

Address the commit-review follow-ups:
- TOCTOU/DNS-rebinding: pin the socket to the validated IP via a custom lookup
  on Node http/https (hostname still used for Host header + TLS SNI), instead of
  letting net.fetch re-resolve after validation.
- Range coverage: classify resolved addresses with ipaddr.js and allow only
  public unicast, rejecting all special-use IPv4/IPv6 ranges (CGNAT, reserved,
  multicast, IPv6 ULA, IPv4-mapped, ...) — replaces the bespoke checks.
- Redirects are still not followed (Node http.get does not auto-follow).

Author: jthrilly

.eslintrc.json

@@ -123,7 +123,8 @@
                 "reduxstore",
                 "renderer",
                 "utils",
-                "loopback"
+                "loopback",
+                "unicast"
              ],
              "skipIfMatch": [
                 "http(s)?://[^s]*",

package-lock.json

@@ -128,6 +128,7 @@
     "archiver": "^4.0.1",
     "d3-force": "~3.0.0",
     "electron-devtools-installer": "^4.0.0",
+    "ipaddr.js": "~2.4.0",
     "path-browserify": "~1.0.1"
   },
   "overrides": {

package.json

@@ -1,43 +1,60 @@
-import { app, net } from 'electron';
+import { app } from 'electron';
 import fs from 'node:fs';
 import path from 'node:path';
+import http from 'node:http';
+import https from 'node:https';
 import dns from 'node:dns';
-import { isIP } from 'node:net';
 import { randomUUID } from 'node:crypto';
+import ipaddr from 'ipaddr.js';
 
-const isPrivateIPv4 = (ip) => {
-  const [a, b] = ip.split('.').map(Number);
-  if (a === 0 || a === 127 || a === 10) { return true; } // unspecified, loopback, private
-  if (a === 172 && b >= 16 && b <= 31) { return true; } // private
-  if (a === 192 && b === 168) { return true; } // private
-  if (a === 169 && b === 254) { return true; } // link-local
-  return false;
-};
-
-const isPrivateIPv6 = (ip) => {
-  const addr = ip.toLowerCase();
-  if (addr === '::1' || addr === '::') { return true; } // loopback, unspecified
-  const mapped = addr.match(/::ffff:(\d+\.\d+\.\d+\.\d+)$/); // IPv4-mapped
-  if (mapped) { return isPrivateIPv4(mapped[1]); }
-  if (/^f[cd]/.test(addr)) { return true; } // unique-local fc00::/7
-  if (/^fe[89ab]/.test(addr)) { return true; } // link-local fe80::/10
-  return false;
+// Only ordinary public unicast addresses are allowed; every special-use range
+// (loopback, private, link-local, CGNAT, reserved, multicast, IPv6 ULA, ...) is
+// rejected. ipaddr.process() also unmaps IPv4-in-IPv6 before classifying.
+const isPublicAddress = (address) => {
+  try {
+    return ipaddr.process(address).range() === 'unicast';
+  } catch {
+    return false;
+  }
 };
 
-const isBlockedAddress = (address) => {
-  const kind = isIP(address);
-  if (kind === 4) { return isPrivateIPv4(address); }
-  if (kind === 6) { return isPrivateIPv6(address); }
-  return true; // not a resolvable IP literal: refuse
-};
+const fetchToBuffer = (parsed, pinned) => new Promise((resolve, reject) => {
+  const lib = parsed.protocol === 'https:' ? https : http;
+  const request = lib.get(
+    parsed.href,
+    {
+      // Pin the socket to the address we already validated, so a DNS rebind
+      // between validation and connection cannot point us at an internal host.
+      // The hostname is still used for the Host header and TLS SNI.
+      lookup: (_hostname, _options, callback) => callback(null, pinned.address, pinned.family),
+      timeout: 60000,
+    },
+    (response) => {
+      const { statusCode } = response;
+      // Node http does not follow redirects; any non-200 (incl. a 3xx that
+      // could point at a blocked host) is treated as a failure.
+      if (statusCode !== 200) {
+        response.resume();
+        reject(new Error(`Unexpected response status ${statusCode}`));
+        return;
+      }
+      const chunks = [];
+      response.on('data', (chunk) => chunks.push(chunk));
+      response.on('end', () => resolve(Buffer.concat(chunks)));
+      response.on('error', reject);
+    },
+  );
+  request.on('timeout', () => request.destroy(new Error('Protocol download timed out')));
+  request.on('error', reject);
+});
 
 // Downloads a remote protocol to a temp file. Runs in the main process, where
 // fetch is not subject to the renderer's CORS policy. Returns the temp path,
 // which is inside app temp so the extract step's path guard permits it.
 //
-// SSRF guard: the URL is user-supplied, so we resolve the host and refuse
-// private/loopback/link-local targets, and reject redirects (which could
-// otherwise bounce a public host to an internal address).
+// SSRF guard: the URL is user-supplied, so we resolve the host, refuse any
+// non-public address, and pin the connection to the validated IP (defeating
+// DNS rebinding). Redirects are not followed.
 const downloadProtocol = async (url) => {
   let parsed;
   try {
@@ -50,16 +67,11 @@ const downloadProtocol = async (url) => {
   }
 
   const addresses = await dns.promises.lookup(parsed.hostname, { all: true });
-  if (addresses.length === 0 || addresses.some(({ address }) => isBlockedAddress(address))) {
-    throw new Error('Refusing to download from a private, loopback, or link-local address.');
-  }
-
-  const response = await net.fetch(parsed.href, { redirect: 'error' });
-  if (!response.ok) {
-    throw new Error(`Unexpected response status ${response.status}`);
+  if (addresses.length === 0 || addresses.some(({ address }) => !isPublicAddress(address))) {
+    throw new Error('Refusing to download from a non-public address.');
   }
 
-  const buffer = Buffer.from(await response.arrayBuffer());
+  const buffer = await fetchToBuffer(parsed, addresses[0]);
   const destination = path.join(app.getPath('temp'), `${randomUUID()}.netcanvas`);
   await fs.promises.writeFile(destination, buffer);
   return destination;