[E30-S01] Hardened fetch service (core) #116

New Issue

2026-08-27T00:03:25Z

kpcto commented

2026-08-27 00:03:25 +00:00

Parent epic: [E30] Embeds (#56)

Intent

Provide a single core-owned outbound fetch service hardened against SSRF, used by oEmbed resolution, thumbnail download and the future link checker.

Acceptance criteria

Resolve DNS first and reject private, loopback, link-local, multicast and cloud metadata ranges
Re-check the resolved address after every redirect, up to a maximum of three
Pin the connection to the pre-resolved address to close the DNS-rebinding window
Enforce a 10-second timeout and a 5 MB response cap on every fetch
Ship a table-driven SSRF suite covering private ranges, metadata addresses, redirect chains and DNS rebinding
Keep the service core-owned so no extension writes its own outbound fetch

Explicitly out of scope

The provider allowlist (E30-S02) and oEmbed resolution (E30-S03) consume this service, not extend it
Worker network-layer egress restriction is deployment-scoped

Test plan

Run the table-driven SSRF test suite and assert every prohibited range is rejected

Rollback note

Roll back to the previous fetch implementation; the API surface is unchanged

Owning stream

platform

Risk quadrant

agent-full

> Parent epic: [E30] Embeds (#56) ## Intent Provide a single core-owned outbound fetch service hardened against SSRF, used by oEmbed resolution, thumbnail download and the future link checker. ## Acceptance criteria - Resolve DNS first and reject private, loopback, link-local, multicast and cloud metadata ranges - Re-check the resolved address after every redirect, up to a maximum of three - Pin the connection to the pre-resolved address to close the DNS-rebinding window - Enforce a 10-second timeout and a 5 MB response cap on every fetch - Ship a table-driven SSRF suite covering private ranges, metadata addresses, redirect chains and DNS rebinding - Keep the service core-owned so no extension writes its own outbound fetch ## Explicitly out of scope - The provider allowlist (E30-S02) and oEmbed resolution (E30-S03) consume this service, not extend it - Worker network-layer egress restriction is deployment-scoped ## Test plan - Run the table-driven SSRF test suite and assert every prohibited range is rejected ## Rollback note - Roll back to the previous fetch implementation; the API surface is unchanged ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint M milestone 2026-08-27 00:03:25 +00:00

kpcto added the

labels 2026-08-27 00:03:25 +00:00

kpcto referenced this issue

2026-08-27 08:05:17 +00:00

[E30-S01-T01] Hardened fetch service (core) #311

Sign in to join this conversation.