[kawacukennedy]

What?

Block remote image fetches to private/internal IP addresses and cap redirect chains to 5 hops. Reuse a single HTTP client per image fetch instead of creating one per call.

Why?

A malicious HTML email could embed images pointing at internal services (e.g. cloud metadata at 169.254.169.254, or 127.0.0.1). Viewing such an email triggered an outbound request to the attacker-controlled URL, enabling SSRF.

The default HTTP client also followed up to 10 redirects, allowing SSRF via redirect chains.

[floatpanebot]

Hi @kawacukennedy! Please fix the following issues with your PR:

• Title: Is too long (55 characters). The PR title must be strictly under 40 characters.
• Body: Missing the ## What? or ## Why? headings required by the PR template.

[floatpanebot]

Benchmark report — no significant change

Metrics worse: 0 · better: 0 (threshold: ±3%).

benchstat output

goos: linux
goarch: amd64
pkg: github.com/floatpane/matcha/backend
cpu: AMD EPYC 7763 64-Core Processor                
                           │   old.txt    │               new.txt               │
                           │    sec/op    │    sec/op     vs base               │
ParseSearchQuery_Simple-4    6.451µ ± 58%   3.038µ ± 27%        ~ (p=0.310 n=6)
ParseSearchQuery_Complex-4   7.701µ ± 26%   8.670µ ± 42%        ~ (p=0.699 n=6)
TokenizeSearchQuery-4        4.480µ ± 24%   4.066µ ± 24%        ~ (p=0.589 n=6)
geomean                      6.060µ         4.748µ        -21.64%

                           │   old.txt   │              new.txt               │
                           │    B/op     │    B/op     vs base                │
ParseSearchQuery_Simple-4    26.00 ± 23%   26.00 ± 0%       ~ (p=1.000 n=6)
ParseSearchQuery_Complex-4   762.0 ±  0%   762.0 ± 0%       ~ (p=1.000 n=6) ¹
TokenizeSearchQuery-4        176.0 ±  0%   176.0 ± 0%       ~ (p=1.000 n=6) ¹
geomean                      151.6         151.6       +0.00%
¹ all samples are equal

                           │  old.txt   │              new.txt               │
                           │ allocs/op  │ allocs/op   vs base                │
ParseSearchQuery_Simple-4    2.000 ± 0%   2.000 ± 0%       ~ (p=1.000 n=6) ¹
ParseSearchQuery_Complex-4   23.00 ± 0%   23.00 ± 0%       ~ (p=1.000 n=6) ¹
TokenizeSearchQuery-4        9.000 ± 0%   9.000 ± 0%       ~ (p=1.000 n=6) ¹
geomean                      7.453        7.453       +0.00%
¹ all samples are equal

pkg: github.com/floatpane/matcha/tui
                    │    old.txt    │              new.txt               │
                    │    sec/op     │    sec/op     vs base              │
LogPanelView-4         176.0µ ±  8%   162.0µ ± 88%       ~ (p=0.310 n=6)
SearchOverlayView-4    179.1µ ±  8%   167.9µ ±  7%       ~ (p=0.065 n=6)
InboxConstruction-4   1068.2µ ± 18%   931.0µ ± 19%       ~ (p=0.093 n=6)
geomean                322.9µ         293.7µ        -9.06%

                    │    old.txt    │               new.txt               │
                    │     B/op      │     B/op       vs base              │
LogPanelView-4        44.67Ki ± 51%   44.67Ki ±  0%       ~ (p=0.455 n=6)
SearchOverlayView-4   56.15Ki ± 41%   56.16Ki ± 41%       ~ (p=0.418 n=6)
InboxConstruction-4   874.5Ki ±  0%   874.5Ki ±  0%       ~ (p=0.905 n=6)
geomean               129.9Ki         129.9Ki        +0.01%

                    │   old.txt   │              new.txt              │
                    │  allocs/op  │  allocs/op   vs base              │
LogPanelView-4         714.0 ± 0%    714.0 ± 0%       ~ (p=0.455 n=6)
SearchOverlayView-4    926.0 ± 0%    926.0 ± 0%       ~ (p=0.688 n=6)
InboxConstruction-4   3.483k ± 0%   3.483k ± 0%       ~ (p=0.965 n=6)
geomean               1.321k        1.321k       -0.00%

_{auto-generated by benchmarks.yml}

Formatting issues have been resolved. Thank you!

[floatpanebot]

This has had no activity for 45 days. It will be closed in 21 days unless updated. Comment or remove the stale label to keep it open.

[kawacukennedy]

Hi @andrinoff — this PR is still open and all CI checks are green; just keeping it off the stale queue. Happy to rebase/adjust if anything needs updating. Thanks!

[floatpanebot]

This has had no activity for 45 days. It will be closed in 21 days unless updated. Comment or remove the stale label to keep it open.

[kawacukennedy]

Rebased onto the new v1.0.0 master to clear the conflict (also picked up the shared-client helper that landed since). The fix is unchanged in intent:

• isPrivateHost rejects loopback / link-local / RFC1918 targets before any request is made.
• Remote image fetches go through a shared client with a hard redirect cap.
• Fail-closed on DNS errors.

go build ./..., go vet, make test and golangci-lint are green locally, and the PR is now MERGEABLE.

[kawacukennedy]

CI note: the only failing check here is govulncheck, and it's a pre-existing issue on master (not caused by this PR). A new Go stdlib advisory, GO-2026-6809, was published after go 1.26.9 and is fixed in go 1.26.10; the repo still pins 1.26.9.

I've opened #1749 to bump the toolchain (also reachable via fetch → pkcs7 → x509). Once that lands, this PR's govulncheck will go green. Everything else in the matrix is passing.