Kristjan ESPERANTO 96c18ec8b0 fix(cors): prevent SSRF via DNS rebinding (#4090) ...

PR #4084 blocked SSRF by checking the IP before `fetch()` — but
`fetch()` resolves DNS again on its own. With DNS rebinding (TTL=0,
alternating IPs) an attacker can slip a private IP through between check
and connection.

Fix: resolve DNS once, validate, pin the validated IP for the
connection.

No second DNS query → no rebinding window. `isPrivateTarget()` is gone,
code is shorter than before.

Not a likely attack for a typical MagicMirror setup, but it doesn't add
complexity so there's no reason not to close the gap.

2026-04-04 20:40:14 +02:00

..

classes

[core] refactor: enable ESLint rule require-await and handle detected issues (#4038)

2026-02-25 10:55:56 +01:00

functions

fix(cors): prevent SSRF via DNS rebinding (#4090)

2026-04-04 20:40:14 +02:00

global_vars

move default modules from /modules/default to /defaultmodules (#4019)

2026-01-27 08:37:52 +01:00

modules/default

SMHI: migrate to SNOW1gv1 API (replace deprecated PMP3gv2) (#4082)

2026-04-03 11:04:09 +02:00