SsrfGuard

Refuses navigation to addresses a caller-supplied URL should never reach.

A library that fetches an arbitrary URL inside someone else's application is an SSRF primitive unless it declines the places an attacker wants: loopback, private ranges, link-local, and the cloud metadata endpoint.

Two properties are deliberate and load-bearing:

• It fails closed. A URL that cannot be parsed, or a host that cannot be resolved, is refused rather than allowed. An address we cannot classify is not an address we can vouch for.

• It holds no state. The decision comes only from the URL and the caller's dev.webdroid.BrowserConfig.allowPrivateAddresses. There is no global switch that can weaken it for the whole process.