Struct SsrfGuard 

pub struct SsrfGuard {
    pub allowed_schemes: Vec<String>,
    pub blocked_hosts: Vec<String>,
    pub resolve_dns: bool,
    pub check_private_ips: bool,
}

SSRF (Server-Side Request Forgery) protection configuration.

Validates hyperlinks extracted from DOCX documents against a set of allowed schemes, blocked hosts, and optionally resolves DNS to check for private / loopback IP addresses.

Examples

use easydoc_reader::security::SsrfGuard;

let guard = SsrfGuard::new();
assert!(guard.check_url("https://example.com").is_ok());
assert!(guard.check_url("http://127.0.0.1/admin").is_err());
assert!(guard.check_url("ftp://example.com").is_err());

Fields

allowed_schemes: Vec<String>

Allowed URI schemes (lowercase). Default: ["http", "https", "mailto"].

blocked_hosts: Vec<String>

Blocked host names (lowercase). Default: ["localhost"].

resolve_dns: bool

Whether to resolve DNS names and check the resulting IP addresses against private / loopback ranges. Default: true.

check_private_ips: bool

Whether to check IP addresses against private / loopback / link-local ranges. Default: true. Set to false in permissive mode.

Implementations

impl SsrfGuard

pub fn new() -> Self

Creates a guard with the default conservative policy.

Allows http, https, mailto schemes; blocks localhost and all private / loopback IP ranges; resolves DNS to verify host names.

pub fn permissive() -> Self

Creates a permissive guard that only enforces scheme restrictions.

No hosts are blocked, DNS resolution is disabled, and private IP ranges are not checked. Useful when the caller only needs basic scheme validation.

pub fn check_url(&self, url: &str) -> Result<(), String>

Checks whether the given URL passes all SSRF protection rules.

Errors

Returns a human-readable error message describing the violation.

Trait Implementations

impl Clone for SsrfGuard

fn clone(&self) -> SsrfGuard

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SsrfGuard

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SsrfGuard

fn default() -> Self

Returns the “default value” for a type.