# Input-ingestion security hardening

The input pipeline now applies these protections at the resolver boundary:

- URL fetching accepts only HTTP(S), rejects URL credentials and malformed ports, resolves using the scheme's correct default port, and rejects hostnames with any non-global DNS answer when private URLs are disabled.
- Redirects are handled manually, with each destination revalidated before the next request.
- HTTPX environment proxy settings are not inherited for remote media fetches, avoiding an ambient proxy changing the destination semantics.
- Remote downloads remain streamed to disk with a hard byte limit, including responses that omit or misstate Content-Length. Partial files are removed on download/validation failures.
- Client filenames are normalized across POSIX and Windows separators and reject control characters and quote characters that can corrupt response headers.

## Deployment notes and remaining limits

- `ALLOW_PRIVATE_URLS=true` intentionally disables the private-address block; only enable it in a trusted, isolated environment.
- DNS validation and the HTTP client's subsequent connection resolution are separate operations. For hostile URL-fetching environments, production-grade SSRF protection should additionally pin the connection to a validated IP while preserving TLS hostname verification, or enforce egress restrictions at the network layer.
- Multipart parsing can spool uploads before application-level per-file limits are applied. Enforce request-body limits at the reverse proxy/ASGI boundary as well as in the resolver.
- Source-level regression tests were added but have not been run in the hosted environment. Deployment and live SSRF tests remain unverified.