security: block SSRF to AWS IMDS via missing 169.254.0.0/16 in CanvasHttp blocked_ip_ranges

[girishgupta211]

Summary

The url parameter on POST /api/v1/users/self/files allows authenticated users to trigger server-side HTTP requests. CanvasHttp.blocked_ip_ranges was missing 169.254.0.0/16 (RFC 3927 link-local), allowing requests to reach the AWS Instance Metadata Service (169.254.169.254) and retrieve IAM credentials.

Affected file: gems/canvas_http/lib/canvas_http.rb

Root cause: blocked_ip_ranges did not include the link-local CIDR block:
```ruby

Before (vulnerable)

@blocked_ip_ranges || [
"127.0.0.1/8",
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16",
"fd00::/8"
]

After (fixed)

@blocked_ip_ranges || [
"127.0.0.1/8",
"10.0.0.0/8",
"172.16.0.0/12",
"192.168.0.0/16",
"169.254.0.0/16",
"fd00::/8"
]
```

Impact

Any authenticated user could POST {"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>"} and retrieve live AWS AccessKeyId, SecretAccessKey, and Token from the EC2 instance running Canvas.

Test plan

• POST /api/v1/users/self/files with url: "http://169.254.169.254/..." now returns an error instead of fetching metadata
• Normal file uploads (browser → S3) are unaffected
• URL-based uploads pointing to public URLs continue to work
• Existing private IP blocks (10.x, 172.16.x, 192.168.x) still blocked

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}