Waleed afcbcf2b54 fix(tools): pin resolved IP in DB connectors to prevent DNS-rebinding SSRF (#4725) ...

* fix(tools): pin resolved IP in DB connectors to prevent DNS-rebinding SSRF

`validateDatabaseHost` resolved an IP that was then discarded — drivers re-resolved
the hostname at connect time, enabling DNS-rebinding TOCTOU.

- mongodb: pass resolved IP via MongoClient `lookup` option
- mysql: pin TCP socket via `stream` factory; keep hostname for TLS servername
- postgresql: connect to resolved IP; pass `ssl` object with `servername` for SNI
- redis: parse URL explicitly and pass options-only (URL+options breaks override
  due to ioredis's lodash.defaults); pin host and set `tls.servername` for rediss
- neo4j: pin IP for plain `bolt://`; leave `bolt+s`/`neo4j+s` unchanged to keep
  Aura cert validation working (driver hardcodes servername with no override)

* chore(tools): remove explainer comments from DB connector SSRF fix

* fix(tools): add explicit TCP timeout to mysql stream factory

* fix(tools): unify postgres ssl handling to send SNI in preferred mode

* fix(tools): preserve postgres 'preferred' fallback behavior for backward compat

* fix(tools): reject non-numeric Redis URL db segment instead of silently using db 0

2026-05-22 10:33:36 -07:00

..

docs

feat(mailer): add AWS SES and SMTP providers with auto-detect fallback (#4710)

2026-05-21 19:27:33 -07:00

realtime

chore(utils): migrate to shared random/ID utilities and add enforcement linting (#4623)

2026-05-15 17:31:27 -07:00

sim

fix(tools): pin resolved IP in DB connectors to prevent DNS-rebinding SSRF (#4725)

2026-05-22 10:33:36 -07:00