Fix test mocking of celery task request

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
2026-03-23 14:40:36 +00:00
parent b0fe1a014a
commit cee6d6d4e1
23 changed files with 261 additions and 61 deletions
@@ -27,11 +27,11 @@ def is_private_ip(hostname: str) -> bool:
                    return True
            return False
        except (socket.gaierror, socket.error):
-            # Cannot resolve - allow for testing/development
-            # In production, DNS should work properly
-            # Log this for debugging
-            logger.warning(f"Could not resolve hostname: {hostname}")
-            return False  # Changed from True to False to allow external domains in tests
+            # Cannot resolve.
+            # Fail securely: block unresolved domains to prevent DNS rebinding
+            # and SSRF bypasses via unresolvable addresses.
+            logger.warning(f"Could not resolve hostname (blocking securely): {hostname}")
+            return True


 def join_url(base: str, *parts: str) -> str: