Module netloc 

Recognizing a network location that never leaves the machine.

The behavioral taxonomy has always had the loopback rung on network.direction (v1.4 §2.5), and reader admits up to it — but nothing derived it from an actual host, so every endpoint read as remote. That forced an all-or-nothing choice on flags like aws --endpoint-url: admit it and an authenticated call can be redirected to an attacker’s host, or withhold it and deny the developer running DynamoDB Local.

This module decides that one question — does this value name THIS machine? — and it is the only place that decides it.

Why it is written as a positive recognizer

Being wrong in one direction is an inconvenience and in the other a redirected authenticated request, so this is an allowlist over a tiny vetted set of spellings, and everything it does not positively recognize is remote. http://2130706433/ really is loopback and this returns false for it; that is the intended behavior, not a gap to close. Adding a spelling is cheap; missing a bypass is not.

The bypasses it is built to survive

A host string is attacker-controlled, and the attack is always to make our parse disagree with the tool’s. The cases that drive this implementation:

• http://localhost@evil.com/ — the authority’s host is evil.com; localhost is userinfo.
• http://evil.com\@localhost/ — WHATWG treats \ as a path separator, so the host is evil.com; splitting on @ first would read it as localhost.
• http://evil.com#@localhost and ?@localhost — the fragment/query start ends the authority.
• http://localhost.evil.com/ — a prefix, not the host.
• http://127.0.0.1.evil.com/ — likewise.
• http://0177.0.0.1/ — leading zeros are octal to some resolvers and decimal to others; an ambiguous spelling is not recognized at all.
• Percent-encoding and non-ASCII (%6c, IDN homographs) — the host charset is enforced after extraction, so no decoding step exists to disagree about.

Functions

is_loopback

Whether value names a network location on this machine.