security: block SSRF in dashboard OpenWeb fetches

Audited upstream baseline (2026-07-15)

dashboard/backend/handlers/openweb.go accepts a caller-provided HTTP(S) URL. fetchWebDirect constructs a normal http.Client and performs the request after scheme validation, but it does not enforce a destination policy after DNS resolution. Its redirect callback limits redirect count but does not revalidate each redirect destination.

An authorized caller can therefore make the dashboard backend attempt connections to loopback, private, link-local, metadata, or otherwise internal addresses reachable from the dashboard network. Hostname checks alone are insufficient because DNS resolution and redirects can change the effective destination.

Required behavior

• Define a deny-by-default destination policy for the direct-fetch path, with an explicit allowlist mechanism if private targets are a supported operator use case.
• Resolve and validate every candidate IP before dialing; reject loopback, unspecified, multicast, private, link-local, and cloud-metadata destinations for the default public-web policy.
• Reapply the same policy to every redirect.
• Use a transport/dialer that prevents DNS rebinding or a check-then-connect race.
• Apply equivalent policy to proxy/reader modes or document why their trust boundary differs.
• Return a safe error without exposing internal network details.

Acceptance criteria

• Direct IP, hostname, IPv4/IPv6, alternate-IP notation, and mixed-resolution cases are tested.
• Redirects from an allowed public URL to a denied destination are blocked.
• DNS rebinding/check-to-dial bypasses are covered by the transport design and tests.
• Cloud metadata and link-local ranges are denied by default.
• Logs redact URL credentials/query secrets and do not expose resolved internal addresses.
• Existing public HTTP(S) fetch behavior remains functional.

Relevant surfaces

dashboard/backend/handlers/openweb.go, dashboard authentication/authorization, HTTP client construction, deployment docs, and security tests.