Problem
The original issue asked to prove the Stellar service's SSRF guards fail closed and to fix the redirect gap. That largely landed: tests/test_stellar_security.py covers private/link-local/loopback/reserved IP literals, obviously-private hostnames, redirect refusal, request-time host resolution, the strict-validation toggle, size caps, and 404/malformed-JSON error mapping, and both StellarService and SorobanRpcClient now refuse redirects. A few adversarial cases from the original list remain uncovered.
Context
app/services/stellar.py and app/services/soroban_rpc.py — validate_endpoint_url, _check_url, allow_redirects=False, response-size caps, and the injectable host_resolver.tests/test_stellar_security.py — existing adversarial tests.
The underlying SSRF tests and the redirect-gap fix have now landed; this issue tracks the remaining cases.
Scope
Finish the matrix: the remaining cases are timeout behavior and exotic host encodings.
Requirements
- Timeout behavior: add a test that a slow (never-finishing) response aborts within the configured timeout, using an injectable transport that blocks past the timeout (assert the service raises
NetworkError/SorobanRpcUnavailableError rather than hanging).
- Exotic host forms: mixed-case hosts, trailing-dot hosts, and URL-encoded hosts in
validate_endpoint_url (assert they are either normalized-then-checked or rejected; document the chosen behavior in a comment).
- DNS-related bypass: document (in a test comment or
docs/security.md) what can and cannot be tested without a custom resolver; add the trivial DNS cases that are possible with the injectable host_resolver.
- Keep all existing fail-closed assertions; do not weaken guards to make tests pass.
Acceptance Criteria
- The timeout-abort case is covered for at least one of the two clients.
- Exotic-host cases are explicitly asserted.
- The DNS-bypass limitation is documented.
- Existing
tests/test_stellar_security.py / tests/test_stellar_service.py stay green.
Testing
- The new tests themselves (mocked transport; no real network).
Dependencies
Out of Scope
- New SSRF protections (the guards already exist); network access.
Expected Outcome
A complete, documented adversarial matrix proving the Stellar/RPC clients fail closed.
Problem
The original issue asked to prove the Stellar service's SSRF guards fail closed and to fix the redirect gap. That largely landed:
tests/test_stellar_security.pycovers private/link-local/loopback/reserved IP literals, obviously-private hostnames, redirect refusal, request-time host resolution, the strict-validation toggle, size caps, and 404/malformed-JSON error mapping, and bothStellarServiceandSorobanRpcClientnow refuse redirects. A few adversarial cases from the original list remain uncovered.Context
app/services/stellar.pyandapp/services/soroban_rpc.py—validate_endpoint_url,_check_url,allow_redirects=False, response-size caps, and the injectablehost_resolver.tests/test_stellar_security.py— existing adversarial tests.The underlying SSRF tests and the redirect-gap fix have now landed; this issue tracks the remaining cases.
Scope
Finish the matrix: the remaining cases are timeout behavior and exotic host encodings.
Requirements
NetworkError/SorobanRpcUnavailableErrorrather than hanging).validate_endpoint_url(assert they are either normalized-then-checked or rejected; document the chosen behavior in a comment).docs/security.md) what can and cannot be tested without a custom resolver; add the trivial DNS cases that are possible with the injectablehost_resolver.Acceptance Criteria
tests/test_stellar_security.py/tests/test_stellar_service.pystay green.Testing
Dependencies
Out of Scope
Expected Outcome
A complete, documented adversarial matrix proving the Stellar/RPC clients fail closed.