Fix SSRF in Java and Spring Boot

// No validation at all: parse the URL and hand the host to the resolver.
private static String[] target(String rawUrl) {
    Urls.Parsed u = Urls.parse(rawUrl);
    int port = u.port() == -1 ? ("https".equals(u.scheme()) ? 443 : 80) : u.port();
    String hostHeader = u.port() == -1 ? u.host() : u.host() + ":" + u.port();
    return new String[] {u.host(), String.valueOf(port), hostHeader, u.path(), u.origin()};
}

private static final Set<String> ALLOWED_SCHEMES = Set.of("http", "https");
private static final Set<Integer> ALLOWED_PORTS = Set.of(80, 443);

// Private, loopback, link-local and other non-public ranges in one table, so the
// policy is reviewable in one place.
private record Cidr(byte[] prefix, int len) {}

private static final List<Cidr> DENY_V4 = parseCidrs(
    "0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
    "172.16.0.0/12", "192.0.0.0/24", "192.0.2.0/24", "192.88.99.0/24", "192.168.0.0/16",
    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4");

private record Target(String ip, int port, String hostHeader, String path, String origin) {}

// inet_aton-style parse so decimal (2130706433), octal (0177.0.0.1) and hex
// (0x7f.0.0.1) literals are recognised as addresses rather than trusted as names.
private static byte[] parseIpLiteral(String host) {
    String inner = host.startsWith("[") && host.endsWith("]") ? host.substring(1, host.length() - 1) : host;
    if (inner.indexOf(':') >= 0) {
        try {
            return InetAddress.getByName(inner).getAddress(); // IPv6 literal: no DNS
        } catch (Exception e) {
            return null;
        }
    }
    if (!inner.equals(host)) {
        return null; // bracketed but not IPv6
    }
    String[] parts = host.split("\\.", -1);
    if (parts.length < 1 || parts.length > 4) {
        return null;
    }
    long[] nums = new long[parts.length];
    for (int i = 0; i < parts.length; i++) {
        String p = parts[i];
        try {
            if (p.matches("0[xX][0-9a-fA-F]+")) {
                nums[i] = Long.parseLong(p.substring(2), 16);
            } else if (p.matches("0[0-7]*")) {
                nums[i] = p.equals("0") ? 0 : Long.parseLong(p, 8);
            } else if (p.matches("[1-9][0-9]*")) {
                nums[i] = Long.parseLong(p);
            } else {
                return null;
            }
        } catch (NumberFormatException e) {
            return null;
        }
    }
    long[] caps = {0xffffffffL, 0xffffffL, 0xffffL, 0xffL};
    int last = nums.length - 1;
    if (nums[last] > caps[last]) {
        return null;
    }
    for (int i = 0; i < last; i++) {
        if (nums[i] > 0xff) {
            return null;
        }
    }
    long value = switch (nums.length) {
        case 1 -> nums[0];
        case 2 -> (nums[0] << 24) | nums[1];
        case 3 -> (nums[0] << 24) | (nums[1] << 16) | nums[2];
        default -> (nums[0] << 24) | (nums[1] << 16) | (nums[2] << 8) | nums[3];
    };
    return new byte[] {(byte) (value >>> 24), (byte) (value >>> 16), (byte) (value >>> 8), (byte) value};
}

private static boolean inRange(byte[] addr, byte[] prefix, int prefixLen) {
    for (int bit = 0; bit < prefixLen; bit++) {
        int idx = bit >> 3;
        int mask = 1 << (7 - (bit & 7));
        if ((addr[idx] & mask) != (prefix[idx] & mask)) {
            return false;
        }
    }
    return true;
}

// Reject anything that is not a public address. IPv4-mapped IPv6 literals already
// arrive as 4-byte addresses; NAT64 and 6to4 carry an embedded IPv4 that is unwrapped.
private static void assertPublic(byte[] original) {
    byte[] addr = original;
    if (addr.length == 16) {
        if (inRange(addr, literal("64:ff9b::"), 96)) {
            addr = new byte[] {addr[12], addr[13], addr[14], addr[15]};
        } else if (inRange(addr, literal("2002::"), 16)) {
            addr = new byte[] {addr[2], addr[3], addr[4], addr[5]};
        } else {
            boolean globalUnicast = inRange(addr, literal("2000::"), 3)
                    && !inRange(addr, literal("2001:db8::"), 32);
            if (!globalUnicast) {
                throw new BlockedRequestException("non-public IPv6 address");
            }
            return;
        }
    }
    for (Cidr cidr : DENY_V4) {
        if (inRange(addr, cidr.prefix(), cidr.len())) {
            throw new BlockedRequestException("non-public IPv4 address");
        }
    }
}

// Parse the URL, enforce the scheme and port allowlists, turn the host into a vetted
// address, and reject (not resolve) IP literals that are not public.
private Target vet(String rawUrl) throws IOException {
    Urls.Parsed u = Urls.parse(rawUrl);
    if (u.scheme() == null || !ALLOWED_SCHEMES.contains(u.scheme())) {
        throw new BlockedRequestException("scheme not allowed");
    }
    if (u.userInfo() != null) {
        throw new BlockedRequestException("credentials in URL not allowed");
    }
    if (u.host() == null) {
        throw new BlockedRequestException("missing host");
    }
    int port = u.port() == -1 ? ("https".equals(u.scheme()) ? 443 : 80) : u.port();
    if (!ALLOWED_PORTS.contains(port)) {
        throw new BlockedRequestException("port not allowed");
    }

    byte[] literal = parseIpLiteral(u.host());
    List<String> addresses = new ArrayList<>();
    if (literal != null) {
        assertPublic(literal);
        addresses.add(ipString(literal, u.host()));
    } else {
        addresses.addAll(resolver.resolve(u.host()));
        if (addresses.isEmpty()) {
            throw new BlockedRequestException("host did not resolve");
        }
        for (String ip : addresses) {
            assertPublic(InetAddress.getByName(bracketless(ip)).getAddress()); // whole set must be public
        }
    }
    String hostHeader = u.port() == -1 ? u.host() : u.host() + ":" + u.port();
    return new Target(addresses.get(0), port, hostHeader, u.path(), u.origin());
}

private static byte[] literal(String ip) {
    try {
        return InetAddress.getByName(ip).getAddress();
    } catch (Exception e) {
        throw new IllegalStateException(e);
    }
}

private static List<Cidr> parseCidrs(String... cidrs) {
    List<Cidr> out = new ArrayList<>();
    for (String cidr : cidrs) {
        String[] parts = cidr.split("/");
        out.add(new Cidr(literal(parts[0]), Integer.parseInt(parts[1])));
    }
    return out;
}

private static String bracketless(String host) {
    return host.startsWith("[") && host.endsWith("]") ? host.substring(1, host.length() - 1) : host;
}

private static String ipString(byte[] addr, String original) {
    try {
        return InetAddress.getByAddress(bracketless(original), addr).getHostAddress();
    } catch (Exception e) {
        return bracketless(original);
    }
}

// A 3xx response is a fresh destination decision, not permission to follow. Re-run
// the full policy on every hop and pin each connection to its own vetted address.
@Override
public FetchResult fetch(String url) throws IOException {
    String target = url;
    for (int hop = 0; hop <= HttpOverSocket.MAX_REDIRECTS; hop++) {
        Target t = vet(target);
        HttpOverSocket.RawResponse response = HttpOverSocket.sendOnce(
                dialer, t.ip(), t.port(), t.hostHeader(), t.path(),
                HttpOverSocket.MAX_RESPONSE_BYTES, HttpOverSocket.TIMEOUT_MS);
        if (response.status() >= 300 && response.status() < 400 && response.location() != null) {
            target = URI.create(t.origin() + t.path()).resolve(response.location()).toString(); // relative to this hop's URL; validated again
            continue;
        }
        return HttpOverSocket.summarise(response);
    }
    throw new BlockedRequestException("too many redirects");
}

// A substring blocklist of "obviously internal" hosts. Looks reassuring; the address
// an attacker actually reaches is decided by DNS, which this never consults.
private static final String[] BLOCKED_SUBSTRINGS = {
    "localhost", "127.0.0.1", "0.0.0.0", "169.254", "10.", "192.168", "172.16", "::1", "metadata", "internal",
};

private static void screen(String host) {
    String lower = host == null ? "" : host.toLowerCase();
    for (String bad : BLOCKED_SUBSTRINGS) {
        if (lower.contains(bad)) {
            throw new BlockedRequestException("host is blocked");
        }
    }
}

private static String[] target(String rawUrl) {
    Urls.Parsed u = Urls.parse(rawUrl);
    int port = u.port() == -1 ? ("https".equals(u.scheme()) ? 443 : 80) : u.port();
    String hostHeader = u.port() == -1 ? u.host() : u.host() + ":" + u.port();
    return new String[] {u.host(), String.valueOf(port), hostHeader, u.path(), u.origin()};
}