nx_url_safety_lib.nx

nx_url_safety_lib.nx -- THE ONE SSRF URL-SAFETY RULER (/compare/mediaingest R11 ge_edge_push). WHY THIS EXISTS. Measured 2026-09-01, corpus_complete=1 over 23,424 sources: the estate has TWO copies of this decision -- csd_url_safe (nx_clean_serve_daemon.nx:101) and ncv_url_safe (nx_cleanview.nx:44). They are byte-for-byte identical logic today, differing only in their function-name prefix, which is exactly the duplicate-ruler defect: they agree by the luck of having been copied, and the next edit to one will not reach the other. For a SECURITY decision that is not a style problem -- it is how one surface quietly keeps admitting a host the other learned to refuse. ⇒ ONE ruler, composed by every caller. WHEN TWO ORGANS MUST AGREE, MAKE DISAGREEMENT IMPOSSIBLE BY CONSTRUCTION RATHER THAN BY REVIEW DISCIPLINE. WHY IT RETURNS A REASON AND NOT A BOOLEAN. This estate has already paid for a boolean here. Its own law: "Four SSRF deny-tests went green while the guard was wholly broken (a url-decoder missing its SPACE terminator swallowed the request line so EVERY url refused as control bytes)." A guard that refuses everything passes every negative test. So: - us_reason() names WHICH RULE FIRED, so a refusal test can assert the rule and not merely the refusal; - us_url_safe() is the 0/1 shim, defined AS us_reason()==US_OK, so the boolean can never disagree with the reason it is derived from; - and any gate over this MUST carry POSITIVE CONTROLS -- inputs that must be ALLOWED -- or a refuse-everything regression scores full marks. SCOPE, STATED SO NOBODY OVER-TRUSTS IT. This is a SYNTACTIC guard on the URL as written. It does NOT resolve DNS, so a public hostname whose A record points at 10.x (DNS rebinding, and the classic time-of-check/time-of-use hole) is ALLOWED here and must be caught at connect time by the fetcher. It blocks all of 172.x rather than only 172.16-31 -- deliberately conservative, and wrong in the direction of refusing a legitimate public host rather than admitting a private one. module: nishi-core.net.url_safety license_tier: ORIGINAL