Garry Tan 0c915f9705 fix(browse): DNS rebinding protection for SSRF blocklist ...

validateNavigationUrl is now async — resolves hostname to IP and checks
against blocked metadata IPs. Prevents DNS rebinding where evil.com
initially resolves to a safe IP, then switches to 169.254.169.254.
All callers updated to await. Tests updated for async assertions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-22 12:23:21 -07:00

..

fixtures

feat: 3-tier eval suite with planted-bug outcome testing (EVALS=1)

2026-03-14 01:17:36 -05:00

bun-polyfill.test.ts

fix: Windows support — Node.js server fallback for Playwright (#255)

2026-03-20 12:22:11 -07:00

commands.test.ts

fix: adjust test key names to avoid redaction pattern collision

2026-03-22 09:58:32 -07:00

config.test.ts

fix: Windows support — Node.js server fallback for Playwright (#255)

2026-03-20 12:22:11 -07:00

cookie-import-browser.test.ts

feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29)

2026-03-13 00:31:41 -07:00

cookie-picker-routes.test.ts

feat: v0.3.2 — project-local state, diff-aware QA, Greptile integration (#36)

2026-03-13 18:10:56 -07:00

find-browse.test.ts

feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226)

2026-03-19 18:20:50 -07:00

gstack-config.test.ts

feat: smart update check with auto-upgrade, snooze backoff, config CLI (v0.3.9) (#62)

2026-03-14 23:28:02 -07:00

gstack-update-check.test.ts

fix: update check cache — 60min UP_TO_DATE TTL + --force flag (v0.4.4) (#110)

2026-03-16 14:14:15 -05:00

handoff.test.ts

feat: browse handoff — headless-to-headed browser switching (v0.7.4) (#201)

2026-03-19 00:38:58 -05:00

path-validation.test.ts

fix: security hardening + issue triage (v0.8.3) (#205)

2026-03-19 01:58:43 -05:00

platform.test.ts

fix: Windows support — Node.js server fallback for Playwright (#255)

2026-03-20 12:22:11 -07:00

snapshot.test.ts

feat: QA restructure, browser ref staleness, eval efficiency metrics (v0.4.0) (#83)

2026-03-15 23:55:39 -05:00

test-server.ts

feat: Phase 3.5 — cookie import, QA testing, team retro (v0.3.1) (#29)

2026-03-13 00:31:41 -07:00

url-validation.test.ts

fix(browse): DNS rebinding protection for SSRF blocklist

2026-03-22 12:23:21 -07:00