Fail closed when validated DNS address list is empty

app/services/downloader.py

@@ -29,7 +29,7 @@ class _PinnedNetworkBackend:
 
     async def connect_tcp(self, host: str, port: int, timeout: float | None = None, local_address: str | None = None, socket_options=None):
         pinned = self.downloader._pinned.get((host.lower().rstrip("."), port))
-        targets = pinned or (host,)
+        targets = pinned if pinned is not None else (host,)
         last_error: Exception | None = None
         for target in targets:
             try:
@@ -91,96 +91,4 @@ class Downloader:
                             current_url = urljoin(current_url, location)
                             continue
                         response.raise_for_status()
-                        declared = self._content_length(response.headers.get("content-length"))
-                        if declared is not None and declared > self.settings.max_upload_size:
-                            raise InputError("Remote media exceeds MAX_UPLOAD_SIZE")
-                        name = self.validator.safe_filename(filename or self._response_filename(response, current_url), "download.bin")
-                        destination = destination_dir / f"{uuid4().hex}_{name}"
-                        size = 0
-                        async with aiofiles.open(destination, "wb") as output:
-                            async for chunk in response.aiter_bytes(1024 * 1024):
-                                size += len(chunk)
-                                if size > self.settings.max_upload_size:
-                                    raise InputError("Remote media exceeds MAX_UPLOAD_SIZE")
-                                await output.write(chunk)
-                        mime_type = response.headers.get("content-type", "").split(";", 1)[0]
-                        mime_type = mime_type or self.validator.infer_mime(destination)
-                        self.validator.validate_declared(name, mime_type, size)
-                        return destination, mime_type
-                except httpx.HTTPStatusError as exc:
-                    if destination is not None:
-                        destination.unlink(missing_ok=True)
-                    raise DownloadError("Remote server rejected the download", details={"status_code": exc.response.status_code}) from exc
-                except httpx.HTTPError as exc:
-                    if destination is not None:
-                        destination.unlink(missing_ok=True)
-                    raise DownloadError("Unable to download remote media") from exc
-                except InputError:
-                    if destination is not None:
-                        destination.unlink(missing_ok=True)
-                    raise
-                except OSError as exc:
-                    if destination is not None:
-                        destination.unlink(missing_ok=True)
-                    raise DownloadError("Unable to store downloaded media") from exc
-            raise DownloadError("Too many redirects while downloading media")
-
-    async def validate_url(self, value: str) -> None:
-        try:
-            parsed = urlparse(value)
-            if (
-                parsed.scheme.lower() not in {"http", "https"} or not parsed.hostname
-                or parsed.username is not None or parsed.password is not None
-                or any(char.isspace() for char in parsed.hostname)
-            ):
-                raise InputError("Only credential-free HTTP and HTTPS media URLs are supported")
-            port = parsed.port
-        except ValueError as exc:
-            raise InputError("Media URL contains an invalid host or port") from exc
-
-        hostname = parsed.hostname.encode("idna").decode("ascii").lower().rstrip(".")
-        target_port = port or (443 if parsed.scheme.lower() == "https" else 80)
-        if self.settings.allow_private_urls:
-            # Explicit opt-in permits private hosts; still pin the current DNS
-            # result to prevent a second, inconsistent lookup by the HTTP client.
-            pass
-        try:
-            records = await asyncio.to_thread(socket.getaddrinfo, hostname, target_port, type=socket.SOCK_STREAM)
-        except (socket.gaierror, OSError) as exc:
-            raise DownloadError("The remote hostname could not be resolved") from exc
-        if not records:
-            raise DownloadError("The remote hostname has no usable address")
-        addresses: list[str] = []
-        for record in records:
-            try:
-                address = ipaddress.ip_address(record[4][0].split("%", 1)[0])
-            except (ValueError, IndexError, TypeError) as exc:
-                raise DownloadError("The remote hostname resolved to an invalid address") from exc
-            if not self.settings.allow_private_urls and not address.is_global:
-                raise InputError("Private, loopback, and link-local URLs are not allowed")
-            if str(address) not in addresses:
-                addresses.append(str(address))
-        self._pinned[(hostname, target_port)] = tuple(addresses)
-
-    @staticmethod
-    def _response_filename(response: httpx.Response, url: str) -> str:
-        disposition = response.headers.get("content-disposition", "")
-        # Parse common filename and RFC 5987 filename* Content-Disposition values.
-        extended = re.search(r"""filename\*\s*=\s*UTF-8''([^;]+)""", disposition, re.I)
-        ordinary = re.search(r"""filename\s*=\s*(?:"([^"]*)"|([^;]+))""", disposition, re.I)
-        if extended:
-            return unquote(extended.group(1).strip().strip('"'))
-        if ordinary:
-            return unquote((ordinary.group(1) or ordinary.group(2) or "").strip())
-        path_name = Path(unquote(urlparse(url).path)).name
-        return path_name or "download.bin"
-
-    @staticmethod
-    def _content_length(value: str | None) -> int | None:
-        if value is None:
-            return None
-        try:
-            parsed = int(value)
-        except (TypeError, ValueError):
-            return None
-        return parsed if parsed >= 0 else None
+