dev_agentandClaude Opus 5.5 177b2dd2e7 Harden recipe fetcher: public-only check, cache copies, rate-limit slots ...

- IsPublic now refuses every non-globally-reachable IPv4 special-purpose
  range (adds 192.0.0.0/24, TEST-NET-1/2/3, 192.88.99.0/24, benchmarking
  198.18.0.0/15) and admits IPv6 only from global unicast 2000::/3, minus
  its documentation, 6to4, Teredo and IETF protocol-assignment ranges.
  Test fixtures move off TEST-NET-3 to public addresses; Fetch-level tests
  cover the new blocked ranges and the public IPv6 path.
- The cache stores and returns copies of Page.Body, so callers cannot
  alter cached bytes or race with other readers.
- The per-host rate limiter advances only when a request is let through;
  a wait that ends with its context holds no slot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-05 12:01:12 -04:00

..

ARCHITECTURE.md

Harden recipe fetcher: public-only check, cache copies, rate-limit slots

2026-10-05 12:01:12 -04:00