fix(security): harden Cloud Task callback dispatch

[Copilot]

Canonical issue

Outcome

Cloud Task callbacks reject SSRF destinations and log-forging input while retaining public HTTP(S) callback delivery.

Scope

• Included:
  • Public-only callback URL validation; reject malformed, CGNAT, site-local, metadata, and mixed DNS answers.
  • Off-loop DNS resolution and numeric-address connection pinning with original Host and TLS SNI.
  • Redirect disablement; three-attempt / total-deadline bound; retries limited to connect failures.
  • CR/LF sanitization for callback and exception log values.
  • Focused callback regression coverage.
• Explicitly excluded:
  • Historical pre-dispatch provenance decision and final human security review.

Risk

• Risk level: medium
• Failure mode: A valid callback may be skipped if its DNS answers include any non-global address.
• Rollback: Revert 21cfb343.

Verification

• Focused tests — pytest tests/unit/test_cloud_routes.py -q --no-cov (104 passed) on 21cfb343
• Required CI — pending current-head workflow execution
• Review threads resolved — canonical PR fix(security): pin cloud callbacks against DNS rebinding #734 reports zero unresolved threads

Production evidence

Not applicable: this is a Python callback path; Vercel previews build apps/web and are non-authoritative.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes Execution: harden cloud callback SSRF and log sanitization (PR #734) #911

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 10:56pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5043e92d-6662-44c7-8ec9-a5fe53044c31

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 21cfb34.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[cursor]

Backlog triage: leaving open. Needed for #1876 (DNS rebinding / callback SSRF). CONFLICTING vs rewritten main — rebase required before any merge.

[github-actions]

⚠️ Repository reconciliation: this PR does not reference exactly one canonical issue.

Please add a Closes #<issue> reference in the PR description so it can be tracked against the delivery plan.

See governance: #898