Prevent DNS rebinding on fetched urls

[ryanfowler]

No description provided.

[Copilot]

Pull request overview

This PR implements DNS rebinding attack prevention by performing DNS resolution and SSRF validation atomically. Instead of validating the hostname before making the request (which creates a TOCTTOU vulnerability), the code now resolves the hostname to an IP address, validates that IP, and then makes the request directly to the validated IP while setting the Host header to the original hostname.

Changes:

• Removed pre-request host validation to eliminate TOCTTOU vulnerability between validation and request
• Added atomic DNS resolution and SSRF validation that resolves hostnames to IPs and validates them in one step
• Implemented request routing directly to validated IP addresses with proper Host header preservation

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
lib/fetch.ts	Refactored SSRF protection to perform atomic DNS resolution and validation, replacing hostname-based validation with IP-based validation to prevent DNS rebinding attacks
lib/fetch.test.ts	Added comprehensive test suite covering DNS rebinding scenarios including single/multiple IP resolution, redirect validation, and spy verification of atomic resolution

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.