Struct NetworkAllowlist 

pub struct NetworkAllowlist { /* private fields */ }

Network allowlist configuration for controlling HTTP access.

URLs must match an entry in the allowlist to be accessed. An empty allowlist means all URLs are blocked (secure by default).

Examples

use bashkit::NetworkAllowlist;

// Create allowlist for specific APIs
let allowlist = NetworkAllowlist::new()
    .allow("https://api.example.com")        // Allow entire host
    .allow("https://cdn.example.com/assets/"); // Allow path prefix

// Check URLs
assert!(allowlist.is_allowed("https://api.example.com/v1/users"));
assert!(allowlist.is_allowed("https://cdn.example.com/assets/logo.png"));
assert!(!allowlist.is_allowed("https://evil.com"));

Pattern Matching

• Scheme: Must match exactly (https vs http)
• Host: Must match exactly (no wildcards)
• Port: Must match (defaults apply: 443 for https, 80 for http)
• Path: Pattern path is treated as a prefix

Implementations

impl NetworkAllowlist

pub fn new() -> Self

Create a new empty allowlist (blocks all URLs)

pub fn allow_all() -> Self

Create an allowlist that allows all URLs.

Warning

This is dangerous and should only be used for testing or when the script is fully trusted.

pub fn block_private_ips(self, block: bool) -> Self

Block requests to private/reserved IP ranges (default: true).

When enabled, requests to hostnames that resolve to private IPs (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fd00::/8, fe80::/10) are blocked.

Security (TM-NET-002, TM-NET-004)

Prevents SSRF via DNS rebinding where an allowed hostname resolves to an internal IP address.

pub fn is_blocking_private_ips(&self) -> bool

Returns whether private IP blocking is enabled.

pub fn allow(self, pattern: impl Into<String>) -> Self

Add a URL pattern to the allowlist.

Pattern Format

Patterns can be:

• Full URLs: https://api.example.com/v1
• Host only: https://example.com
• With port: “http://localhost:8080”

A pattern matches if the requested URL’s scheme, host, and port match, and the requested path starts with the pattern’s path (if specified).

pub fn allow_many( self, patterns: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Add multiple URL patterns to the allowlist.

pub fn check(&self, url: &str) -> UrlMatch

Check if a URL is allowed.

pub fn is_allowed(&self, url: &str) -> bool

Check if a URL is allowed (convenience method).

Returns true if the URL is allowed, false otherwise. This is equivalent to checking if check(url) returns UrlMatch::Allowed.

pub fn is_enabled(&self) -> bool

Check if network access is enabled (has any patterns or allow_all)

Trait Implementations

impl Clone for NetworkAllowlist

fn clone(&self) -> NetworkAllowlist

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NetworkAllowlist

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for NetworkAllowlist

fn default() -> Self

Returns the “default value” for a type.