Ladder should restrict proxying local/reserved IP addresses

[jogerj]

Ladder should never return resources from reserved IP addresses. This is a security risk.

I have deployed Ladder behind a reverse proxy (in my case I used Caddy), both inside docker. I have other services deployed on the same instance that is accessed via Caddy. The problem is that Ladder is able to bypass the reverse proxy and directly make requests on the local machine (e.g. https://ladder.example.com/http://192.168.0.1, where Ladder is hosted behind reverse-proxy at ladder.example.com and a different service, which is normally accessed from the reverse proxy, is hosted at 192.168.0.1). This should never be allowed as the internal connection does not use SSL/TLS and bypasses the reverse proxy where the certs are deployed. Of course there may be certain edge cases where this function is needed, in which case it should be explicitly allowed from a ruleset.

[satonotdead]

Thanks for pointing it out. It seems that Ladder is not currently designed for public use.