Dwi Siswanto c50f92fdd3 refactor: enforce scan network restrictions in network helpers ...

Pass scan options through rendering, variables, matchers, and extractors
so resolve(), public_ip()/publicip(), and jarm() honor -lna and -eh.
These helpers previously performed network I/O outside the scan's network
policy.

Use the scan dialer for HTTP and JARM connections and reject restricted
IP addresses in DNS answers. Validate original and normalized hostnames
to prevent exclusion bypasses through DNS escapes and trailing dots.

Enforce -eh with or without -lna, including in unsigned templates.
Keep local access available without -lna unless excluded, and preserve
configured DNS resolvers, including local ones.

Bind helpers at evaluation time without storing scan state in cached
expressions. Reject network helper calls without initialized scan
context.

Fixes #7769

Signed-off-by: Dwi Siswanto <[email protected]>

2026-09-23 18:53:49 +07:00

..

render_test.go

refactor(protocols): template rendering boundary (#7499)

2026-06-30 03:53:15 +07:00

render.go

refactor: enforce scan network restrictions in network helpers

2026-09-23 18:53:49 +07:00