fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -25,7 +25,7 @@ public static class ForwardedProxyConfiguration

        foreach (var value in networks)
        {
-            if (!IPNetwork.TryParse(value, out var network))
+            if (!IPNetwork.TryParse(value, out var network) || network.PrefixLength == 0)
                throw new InvalidOperationException($"Proxy:KnownNetworks contains an invalid CIDR: {value}");

            options.KnownNetworks.Add(network);