fetch: support wildcard and CIDR patterns in domain allow/deny lists

[dgageot]

What

Extend the fetch toolset's allowed_domains / blocked_domains with two new pattern shapes on top of the existing bare-host and leading-dot forms:

Form	Example	Semantics
Wildcard glob	*.example.com	Alias for .example.com — strict subdomain only (apex excluded). * is allowed only as the leading *. token.
CIDR range	169.254.0.0/16, 10.0.0.0/8, ::1/128, fc00::/7	Matches when the URL host parses as an IP inside the network. Hostname hosts never match a CIDR.

Existing bare (example.com) and leading-dot (.example.com) patterns are unchanged.

Why

Without CIDR support, blocking the cloud-metadata range or a private network meant listing every IP individually. Without *. glob support, users coming from TLS-cert / nginx / curl conventions had to discover the leading-dot form. Both gaps were visible in real configs — see examples/fetch_domain_filtering.yaml.

Security fix included

While reviewing the new code I found that matchesDomain did not normalise IPv4-mapped IPv6 addresses before CIDR / literal-IP comparison. A URL like http://[::ffff:169.254.169.254]/ would parse as IPv6, slip past a 169.254.0.0/16 deny entry, and reach the cloud metadata endpoint anyway. Fixed by canonicalising both sides via net.IP.To4() before matching. Regression tests added.

Validation up-front

validateDomainPattern now rejects malformed CIDRs (10.0.0.0/33) and any non-leading use of * (foo.*, *.*.example.com, bare *) at config-load time, so silent foot-guns become actionable errors.

Files

• pkg/tools/builtin/fetch.go — matchesDomain extended (CIDR + *. glob + IPv4-mapped IPv6 normalisation).
• pkg/config/latest/validate.go — validateDomainPattern syntax check.
• pkg/tools/builtin/fetch_test.go, pkg/config/latest/validate_test.go — table-driven coverage for matcher and validator (incl. SSRF regression cases).
• agent-schema.json, docs/tools/fetch/index.md, examples/fetch_domain_filtering.yaml — descriptions, examples, limitations callout.

Tests

mise lint → 0 issues. mise test → all packages pass.

[docker-agent]

Assessment: 🟢 APPROVE

The CIDR + wildcard domain matching implementation is well-structured. The IPv4-mapped IPv6 normalisation correctly closes the SSRF bypass in both the CIDR path and the string-comparison path. validateDomainPattern cleanly catches malformed CIDRs and invalid wildcard forms at config-load time, and the table-driven test coverage is thorough.

One minor inconsistency was found between the CIDR and non-CIDR normalisation paths (see inline comment). The CIDR path in the changed code uses strings.TrimSuffix(strings.Trim(host, "[]"), ".") (strips brackets and trailing dot), while the non-CIDR normalisation path uses only strings.Trim(host, "[]") (strips brackets only). The practical impact is negligible because url.Hostname() never returns a bracketed-IPv6-with-trailing-dot host, but aligning the two paths would make the code more robust and easier to reason about.

[docker-agent]

[LOW] Inconsistency: non-CIDR IP normalisation path does not strip trailing dot before net.ParseIP

The CIDR path (line 331) correctly chains both bracket-stripping and trailing-dot stripping before calling net.ParseIP:

// CIDR path — correct
ipStr := strings.TrimSuffix(strings.Trim(host, "[]"), ".")
if ip := net.ParseIP(ipStr); ip != nil {

The non-CIDR normalisation path (line 355) only strips brackets, not the trailing dot:

// Non-CIDR path — inconsistent
if ip := net.ParseIP(strings.Trim(host, "[]")); ip != nil {

For a host like [::ffff:169.254.169.254]. (bracketed IPv6 with FQDN trailing dot), strings.Trim(host, "[]") yields ::ffff:169.254.169.254]. (the trailing . is not in the cutset "[]"), so net.ParseIP returns nil and the host falls through un-normalised to the string comparison stage. The bypass is theoretical in practice since url.Hostname() strips brackets and would not return a host in this form — but the inconsistency between the two paths in the changed code is real.

Suggested fix: Apply the same pattern as the CIDR path:

if ip := net.ParseIP(strings.TrimSuffix(strings.Trim(host, "[]"), ".")); ip != nil {