Jeremy Daer 496851b255 Security: Web Push SSRF and IP range bypass ...

Add SSRF protection for web push endpoints:
- Resolve endpoint IP once and pin it for connection
- Validate endpoints resolve to public IPs
- Whitelist permitted push service hosts

Add missing IP ranges to SsrfProtection:
- 100.64.0.0/10 (Carrier-grade NAT, RFC6598)
- 198.18.0.0/15 (Benchmark testing, RFC2544)

Note: link-local (169.254.0.0/16) is already covered by ip.link_local?

2025-12-04 21:35:55 -08:00

..

subscription.rb

Security: Web Push SSRF and IP range bypass

2025-12-04 21:35:55 -08:00