🛡️ Sentinel: [HIGH] Fix SSRF bypass by explicitly blocking private and CGNAT IPs (#627)

* 🛡️ Sentinel: [HIGH] Fix SSRF bypass by blocking private, multicast, and CGNAT IP spaces

- Added `_is_safe_ip` helper to explicitly reject IPs that are private, multicast, unspecified, loopback, link-local, or within the CGNAT range (100.64.0.0/10).
- Updated `validate_hostname` to use this helper for both IP literals and DNS resolution.
- Resolves vulnerability where `is_global = False` alone didn't adequately block CGNAT or specific edge-case private IPs depending on Python versions.

Co-authored-by: abhimehro <84992105+abhimehro@users.noreply.github.com>

* 🛡️ Sentinel: [HIGH] Fix SSRF bypass by explicitly blocking private and CGNAT IPs

- Added `_is_safe_ip` helper to explicitly reject IPs that are multicast or within the CGNAT range (100.64.0.0/10).
- Relies directly on `.is_global` for remaining checks (which correctly covers private, loopback, unspecified, and link-local).
- Declared the CGNAT network at the module level to avoid instantiation on every check.
- Resolves vulnerability where `.is_global` alone didn't adequately block CGNAT IPs depending on Python version.

Co-authored-by: abhimehro <84992105+abhimehro@users.noreply.github.com>

* Update main.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* 🛡️ Sentinel: [HIGH] Fix SSRF bypass by explicitly blocking private and CGNAT IPs

- Added `_is_safe_ip` helper to explicitly reject IPs that are multicast or within the CGNAT range (100.64.0.0/10).
- Relies directly on `.is_global` for remaining checks (which correctly covers private, loopback, unspecified, and link-local).
- Declared the CGNAT network at the module level to avoid instantiation on every check.
- Resolves vulnerability where `.is_global` alone didn't adequately block CGNAT IPs depending on Python version.

Co-authored-by: abhimehro <84992105+abhimehro@users.noreply.github.com>

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

main.py

@@ -1022,6 +1022,18 @@ def _api_client() -> httpx.Client:
 # _rate_limit_info, _rate_limit_lock imported from api_client above
 
 # _parse_rate_limit_headers imported from api_client above
+
+_CGNAT_NETWORK = ipaddress.IPv4Network("100.64.0.0/10")
+
+def _is_safe_ip(ip: ipaddress.IPv4Address | ipaddress.IPv6Address) -> bool:
+    """Checks against CGNAT space, multicast, and relies on is_global for the rest."""
+    if ip.is_multicast:
+        return False
+    if isinstance(ip, ipaddress.IPv4Address) and ip in _CGNAT_NETWORK:
+        return False
+    return ip.is_global
+
+
 @lru_cache(maxsize=128)
 def validate_hostname(hostname: str) -> bool:
     """