SSRF mitigation with URL allowlists and egress controls

                  require 'ipaddr'
require 'resolv'

uri = URI.parse(params[:url])
allowed_hosts = %w[images.example-cdn.com api.partner.com]

raise ActionController::BadRequest, 'invalid scheme' unless %w[https].include?(uri.scheme)
raise ActionController::BadRequest, 'host not allowed' unless allowed_hosts.include?(uri.host)

addresses = Resolv.getaddresses(uri.host).map { |address| IPAddr.new(address) }
forbidden_ranges = [
  IPAddr.new('127.0.0.0/8'),
  IPAddr.new('10.0.0.0/8'),
  IPAddr.new('172.16.0.0/12'),
  IPAddr.new('192.168.0.0/16'),
]

if addresses.any? { |address| forbidden_ranges.any? { |range| range.include?(address) } }
  raise ActionController::BadRequest, 'resolved to forbidden network'
end