9 Commits

Include renames

Author	SHA1	Message	Date
ik	51728bf3f2	test: clean up concurrent cooldown processes	2026-09-11 07:56:01 +07:00
ik	57aa3ffafb	A02/A03: Add state validation and normalize subdomain keys for shared cooldown	2026-09-10 20:34:05 +07:00
ik	d0d208ebd7	A03: Manual redirect control with per-hop validation ... Replace urlopen automatic redirect following with custom HTTPRedirectHandler that raises on 3xx redirects. Each redirect hop is validated (scheme, host, port) before the request is made using _validate_url_before_io(). Key changes: - _StrictRedirectHandler intercepts 301/302/303/307/308 responses - _extract_redirect_url() extracts Location header from redirect responses - fetch_html() manually follows redirects with hop count limit (MAX_REDIRECT_HOPS=5) - Relative redirect URLs resolved with urljoin() before validation - All redirect targets validated against ALLOWED_HOSTS, ALLOWED_PORTS, HTTPS-only Tests: - test_fetch_html_redirect_to_disallowed_host_rejected (mocked redirect) - test_fetch_html_redirect_chain_limit (exceeds MAX_REDIRECT_HOPS) - test_extract_redirect_url_from_headers (Location/location headers) - test_urljoin_resolves_relative_redirects (relative URL resolution)	2026-09-10 06:26:15 +07:00
ik	4ac50db1db	A02: Atomic check-and-reserve with lockfile for cross-process coordination ... - Single exclusive lock covers read-check-write in one critical section - Lockfile pattern ensures cross-process mutual exclusion - Atomic write via temp file + rename after unlock - Flush + fsync before unlock to prevent data loss - Real multi-process test: 3 concurrent processes get exactly 1 reservation - 111 Python tests pass (+2 new tests)	2026-09-10 06:23:14 +07:00
ik	4974f362ac	A03: Validate scheme/host/port before every network I/O ... - _validate_url_before_io: check scheme (HTTPS only), port (80/443), host - fetch_html: recursive redirect validation with hop limit (MAX_REDIRECT_HOPS=5) - Reject non-HTTPS redirects and non-standard ports - All validation happens BEFORE urlopen() call - Updated tests for new validation messages - 109 Python tests pass	2026-09-10 06:11:17 +07:00
ik	79245965ec	A02: Atomic cooldown state with exclusive lock and flush ... - _write_state: write to temp file, fsync, rename atomically - Acquire exclusive lock before any file operations - Flush and fsync before unlock to prevent data loss - Remove stale .tmp file after successful write - Add test for atomic write behavior - 109 Python tests pass	2026-09-10 06:10:35 +07:00
ik	39f66481be	R11: Validate URL host before network I/O — prevent SSRF ... - Add _validate_url_host() to check allowlist before urlopen() - Validate both original URL and redirect target - Reject localhost, internal IPs, and non-allowlisted hosts - Add 2 unit tests for disallowed host rejection - Prevents SSRF attacks via malicious source URLs	2026-09-10 05:45:57 +07:00
ik	486b4e9645	fix: enforce community cooldown per site	2026-09-08 16:32:42 +07:00
ik	3f468799bd	feat: enforce community source cooldown	2026-09-05 07:52:37 +07:00