Block direct requests to private IPs

[M4tthewDE]

Pull request checklist:

• CHANGELOG.md was updated, if applicable

Description

[KararTY]

Nice, TIL https://pkg.go.dev/net#IP.IsPrivate

[Mm2PL]

This will still resolve hosts pointed to by DNS records. For example if we'd have an A record saying localhost.example.com -> 127.0.0.1, this won't ignore 127.0.0.1.

[M4tthewDE]

That should be handled via the ignored hosts imo. It might be worthwhile to add a config option for ignored hosts, since as of now they can only be added by patching the source.

[pajlada]

Go's HTTP client has a way to customize parts of the transport layer, see https://pkg.go.dev/net/http#Client and https://pkg.go.dev/net/http#RoundTripper - with this we should be able to intercept the request after the domain resolving has happened & stop it mid-transit instead
Happy to discuss if this feels like a bad idea

[M4tthewDE]

I was not able to find a way to intercept requests after the domain resolving. If this is not feasible, we could instead make the ignored hosts configurable and maybe add common hosts (e.g. localhost) as a default entry.

[pajlada]

This is a good first effort, so I will go ahead and merge this in as-is, but I won't close #480
Thanks!