fix(ssrf): protect metadata-validation from SSRF attacks

[hummern]

Fix for #4142 - SSRF in Metadata-Validation Service

Vulnerability

The metadata-validation service's method fetched URLs without any validation, allowing attackers to:

• Access internal services via private IP addresses (10.x, 172.16-31.x, 192.168.x)
• Reach cloud metadata endpoints (169.254.169.254)
• Escalate from external URLs to localhost endpoints

Fix

Added comprehensive URL validation with:

• Protocol whitelist: Only http, https, and ipfs allowed
• Private IP blocking: Detects and blocks RFC 1918 ranges (10/8, 172.16/12, 192.168/16)
• Loopback protection: Blocks localhost, 127.0.0.1, ::1
• Cloud metadata blocking: Blocks 169.254.169.254 and metadata.* hostnames
• IP validation: Uses Node.js and for detection
• Graceful handling: Returns status for blocked URLs instead of throwing errors

Files Changed

• : Added validation functions and applied before fetch

Testing

• Existing tests pass
• New validation covers:
  • Valid public URLs (https://example.com)
  • IPFS URLs (ipfs://Qm...)
  • Private IPs (127.0.0.1, 10.0.0.1, 192.168.1.1, 169.254.169.254)
  • Blocked hostnames (metadata.instance-data)

Security Impact

• CVSS 8.6 High → mitigated by URL validation
• Prevents credential exfiltration from cloud metadata services
• Blocks internal network reconnaissance
• Fixes CWE-918 (SSRF)

[kusssal]

Thank you for contributing this fix. This overlaps with #4177, which also adds DNS resolution checks, connection-time address validation, and regression tests.

We are proceeding with #4177 and #4213 as the fix for #4142
This can be closed as superseded to consolidate the implementation.