🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass - #1068

Draft

seonghobae wants to merge 92 commits into

sentinel/fix-empty-hostname-ssrf-14253541902387870366

Commits on Aug 30, 2026

🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass in _is_safe_url
seonghobae
committed
bd42e3c
🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass in _is_safe_url
seonghobae
committed
6eebc27
🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass in _is_safe_url
seonghobae
committed
e70f9b3
🛡️ Sentinel: [HIGH] 빈 호스트명을 통한 SSRF 우회 취약점 수정 (_is_safe_url)
seonghobae
committed
25d8ec6
🛡️ Sentinel: [HIGH] 빈 호스트명을 통한 SSRF 우회 취약점 수정 (_is_safe_url)
seonghobae
committed
583477a

Commits on Sep 1, 2026

Commits on Sep 2, 2026

fix(sast): make empty-host fail-open flow path-aware
seonghobae
committed
cea3656
refactor(sast): isolate empty-host SSRF rule
seonghobae
committed
3101419
test(sast): preserve sibling-except path semantics
seonghobae
committed
183c8a4
merge(develop): sync release dependency baseline
seonghobae
committed
89a0b08
docs(test): explain intentional fixture fallthrough
seonghobae
committed
93d225f
docs(test): explain vulnerable fixture fallthrough
seonghobae
committed
83cfca2
fix(scanner): widen empty-host SSRF return boundaries
seonghobae
committed
e0eb0e6
test(scanner): pin empty-host SSRF review boundaries
seonghobae
committed
ec202c9
docs(security): trace empty-host return semantics
seonghobae
committed
cdc268f
test(ssrf): require unresolved hosts to fail closed
seonghobae
committed
187cf6a
fix(ssrf): fail closed on unresolved webhook hosts
seonghobae
committed
ddc1419
test(controlplane): use resolvable webhook fixtures
seonghobae
committed
62df0db
test(ssrf): make public redirect DNS deterministic
seonghobae
committed
5b79be8
🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass
seonghobae
committed
6dc9948
repair(ssrf): preserve validated predecessor after concurrent overwrite
seonghobae
committed
fad8702
🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass
seonghobae
committed
969df92
repair(ssrf): re-preserve validated tree after repeated overwrite
seonghobae
committed
9436098
🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass
seonghobae
committed
2bc48db
repair(ssrf): preserve reviewed tree after concurrent overwrite
seonghobae
committed
2d1acbe
Trigger CI check re-run for exact coverage edges
seonghobae
committed
a3e6966

Commits on Sep 3, 2026

Trigger CI check re-run for exact coverage edges
seonghobae
committed
81ee5b4
test(ssrf): restore deterministic DNS boundary fixtures
seonghobae
committed
64fe0d3
test(ssrf): cover structural detector edge syntax
seonghobae
committed
38bde3b
fix(ssrf): cover multiline and truthy detector syntax
seonghobae
committed
438c5ae
test(ssrf): require CLI DNS failure to fail closed
seonghobae
committed
cb89d78
Trigger CI check re-run for exact coverage edges
seonghobae
committed
8c06fe7
test(ssrf): preserve credential-only hostless URL regression
seonghobae
committed
ed65fdd
Trigger CI check re-run for exact coverage edges
seonghobae
committed
a8ee7b0
test(ssrf): restore credential-only hostless authority contract
seonghobae
committed
3c015e2

Commits on Sep 4, 2026

Trigger CI check re-run for exact coverage edges
seonghobae
committed
8f675a2
fix(ssrf): require CLI DNS failure to fail closed
seonghobae
committed
ed9fbdc
Trigger CI check re-run for exact coverage edges
seonghobae
committed
c5874ef
fix(ssrf): restore reviewed empty-host detector boundaries
seonghobae
committed
a31d91d
test(ssrf): restore and extend hostless authority regression
seonghobae
committed
5be43e8
test(ssrf): restore reviewed detector edge contracts
seonghobae
committed
bce5490

Commits on Sep 5, 2026

Commits on Sep 6, 2026

Trigger CI check re-run for Strix timeout retry
seonghobae
committed
5897711

Commits on Sep 7, 2026