Apps: harden network whitelist and SSRF-guard app downloads (M: wildcard hosts, SSRF)

[Rigidity]

Part of the security review follow-ups for #785 (Medium severity, network theme). Targets the apps mirror branch.

Findings addressed

M: Bare * host allowed in network whitelist (types/network.rs)
A manifest could request https://*, which CSP treats as match-all — effectively an open connect-src hiding behind an innocuous-looking whitelist entry. Wildcards are now only accepted as a single leading label (*.example.com); bare *, *:443, *., embedded (a*.example.com) and nested (*.*.example.com) wildcards are rejected, with tests.

M: SSRF on URL install/update (lifecycle/snapshot.rs, types/app/view/common.rs)
reqwest::get was used directly on user-supplied app URLs with no address blocklist and default redirect following, so an install URL (or a redirect from it) could reach internal services such as cloud metadata endpoints or LAN hosts. All app-related downloads (manifest, snapshot files, remote icons) now go through a guarded fetch in security/net.rs that:

• resolves the host up front and rejects loopback, RFC1918 private, link-local (incl. 169.254.169.254), CGNAT, unique-local, unspecified, broadcast, documentation, multicast, and IPv4-mapped-IPv6 equivalents
• pins the connection to the vetted addresses (resolve_to_addrs) so DNS rebinding between validation and connect is not possible
• follows redirects manually (max 5 hops) and re-validates every hop
• keeps loopback working only for explicitly-loopback URLs (http://localhost / 127.0.0.1 / ::1), preserving the supported local dev install flow

Notes

• Unit tests cover the address classification and explicit-loopback detection.
• cargo check, cargo clippy --all-targets, and the new unit tests pass locally; relying on CI for the full build.

---

Note

Medium Risk
Security-sensitive networking on install/update and icon fetch paths; behavior changes could block legitimate URLs or mis-resolve DNS, though loopback dev flow is preserved.

Overview
Hardens user-supplied app URL fetches so installs, snapshot downloads, and remote icons no longer use unguarded reqwest::get. New get_with_ssrf_guard in security/net.rs resolves each hop, blocks private/link-local/metadata-style addresses, pins DNS with resolve_to_addrs, follows redirects manually (max 5) with re-validation, and allows http only for explicit loopback hosts for local dev.

Tightens manifest network whitelist hosts so CSP cannot be widened to match-all: only *.example.com-style leading wildcards are allowed; bare *, *:443, *., and embedded/nested * forms are rejected, with new tests.

tokio gains the net feature for async host lookup.

^{Reviewed by Cursor Bugbot for commit d46113a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Hadamcik]

Fixed: 8c4cfa4