From 6a513de4969a59a172b1a0bef60f3c629bd9d2fd Mon Sep 17 00:00:00 2001 From: Julian Lechner Date: Thu, 24 Sep 2026 22:03:28 +0200 Subject: [PATCH] docs(security): strengthen network guidance --- shared/rules/security/references/network.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/shared/rules/security/references/network.md b/shared/rules/security/references/network.md index d478c34..3d63da0 100644 --- a/shared/rules/security/references/network.md +++ b/shared/rules/security/references/network.md @@ -2,5 +2,8 @@ * Use HTTPS and never disable certificate or TLS validation. * Restrict inbound and outbound access to required ports, interfaces, hosts, and protocols. -* Treat user-controlled URLs as dangerous: allowlist schemes and hosts, block localhost, metadata, and internal ranges, and revalidate redirects. -* Set timeouts, response-size limits, bounded retries, and cancellation for remote operations. +* Treat user-controlled URLs as dangerous. Allowlist schemes and destinations, reject loopback, link-local, private, and cloud metadata ranges unless explicitly needed, and validate the resolved destination. +* Revalidate every redirect and DNS resolution to prevent redirects, rebinding, or mixed-address answers from bypassing destination restrictions. Disable automatic redirects when they cannot be safely checked. +* Set connection and overall timeouts, response-size limits, bounded concurrency, bounded retries, and cancellation for remote operations. +* Avoid forwarding ambient credentials, cookies, or authorization headers to a new host or redirect target. +* Use controlled egress where possible and avoid exposing internal error details or response bodies from remote services.