fix: pin validated dns for ssrf checks

tests/security/test_security_network.py

@@ -11,6 +11,8 @@ import pytest
 from nanobot.security.network import (
     configure_ssrf_whitelist,
     contains_internal_url,
+    pin_resolved_url_dns,
+    resolve_url_target,
     validate_url_target,
 )
 
@@ -157,6 +159,25 @@ def test_allows_public_ip():
         assert ok, f"Should allow public IP, got: {err}"
 
 
+def test_resolve_url_target_returns_validated_public_ips():
+    with patch("nanobot.security.network.socket.getaddrinfo", _fake_resolve("example.com", ["93.184.216.34"])):
+        ok, err, resolved_ips = resolve_url_target("http://example.com/page")
+
+    assert ok, err
+    assert resolved_ips == ("93.184.216.34",)
+
+
+def test_pin_resolved_url_dns_prevents_second_resolution_rebind():
+    def _rebinding_resolver(hostname, port, family=0, type_=0):
+        return [(socket.AF_INET, socket.SOCK_STREAM, 0, "", ("169.254.169.254", 0))]
+
+    with patch("nanobot.security.network.socket.getaddrinfo", _rebinding_resolver):
+        with pin_resolved_url_dns("http://example.com/page", ("93.184.216.34",)):
+            infos = socket.getaddrinfo("example.com", 80, socket.AF_UNSPEC, socket.SOCK_STREAM)
+
+    assert infos[0][4][0] == "93.184.216.34"
+
+
 def test_allows_normal_https():
     with patch("nanobot.security.network.socket.getaddrinfo", _fake_resolve("github.com", ["140.82.121.3"])):
         ok, err = validate_url_target("https://github.com/HKUDS/nanobot")