---
# CodeQL Custom Model - SSRF Protection Sanitizers
# This file declares functions that sanitize user-controlled input for SSRF protection.
#
# Architecture: 4-Layer Defense-in-Depth
# Layer 1: Format Validation (utils.ValidateURL)
# Layer 2: Security Validation (security.ValidateExternalURL) - DNS resolution + IP blocking
# Layer 3: Connection-Time Validation (ssrfSafeDialer) - Re-resolve DNS, re-validate IPs
# Layer 4: Request Execution (TestURLConnectivity) - HEAD request, 5s timeout, max 2 redirects
#
# Blocked IP Ranges (13+ CIDR blocks):
# - RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
# - Loopback: 127.0.0.0/8, ::1/128
# - Link-Local: 169.254.0.0/16 (AWS/GCP/Azure metadata), fe80::/10
# - Reserved: 0.0.0.0/8, 240.0.0.0/4, 255.255.255.255/32
# - IPv6 Unique Local: fc00::/7
#
# Reference: /docs/plans/current_spec.md
extensions:
  # Mark ValidateExternalURL as a sanitizer that returns validated data
  # The function returns a sanitized URL string as first return value
  - addsTo:
      pack: codeql/go-all
      extensible: summaryModel
    data:
      # security.ValidateExternalURL sanitizes URLs by:
      # 1. Validating URL format and scheme
      # 2. Performing DNS resolution
      # 3. Blocking private/reserved IP ranges
      # Input: Argument[0] (rawURL string)
      # Output: ReturnValue[0] (validated URL string - safe for HTTP requests)
      - ["github.com/Wikid82/charon/backend/internal/security", "ValidateExternalURL", "Argument[0]", "ReturnValue[0]", "taint", "manual"]

  # Mark url.Parse().String() reconstruction as breaking taint chain
  # When URL is parsed and reconstructed, it creates a new value
  - addsTo:
      pack: codeql/go-all
      extensible: neutralModel
    data:
      # network.IsPrivateIP is a validation function (neutral - doesn't propagate taint)
      - ["github.com/Wikid82/charon/backend/internal/network", "IsPrivateIP", "manual"]