fix(review-feedback-1290): address latest review comments

Author: ZhuLinsen

src/config.py

@@ -41,15 +41,18 @@
 _STOCK_LIST_FETCH_BLOCKED_HOSTS = frozenset(
     {
         "169.254.169.254",
+        "localhost",
         "metadata.google.internal",
         "100.100.100.200",
+        "fd00:ec2::254",
     }
 )
 _STOCK_LIST_FETCH_BLOCKED_IPS = frozenset(
     ipaddress.ip_address(value)
     for value in (
         "169.254.169.254",
         "100.100.100.200",
+        "fd00:ec2::254",
     )
 )
 
@@ -291,7 +294,11 @@ def _is_blocked_stock_list_fetch_ip(ip_address: Any) -> bool:
     if mapped_ipv4 is not None:
         candidates.append(mapped_ipv4)
     return any(
-        candidate.is_link_local or candidate in _STOCK_LIST_FETCH_BLOCKED_IPS
+        candidate.is_link_local
+        or candidate.is_loopback
+        or candidate.is_private
+        or candidate.is_unspecified
+        or candidate in _STOCK_LIST_FETCH_BLOCKED_IPS
         for candidate in candidates
     )
 

tests/test_config_env_compat.py

@@ -583,6 +583,28 @@ def test_stock_list_fetch_api_blocks_metadata_endpoint(
         mock_urlopen.assert_not_called()
         self.assertEqual(config.stock_list, ["000001", "300750"])
 
+    @patch("src.config.setup_env")
+    @patch("src.config.urllib.request.urlopen")
+    @patch.object(Config, "_parse_litellm_yaml", return_value=[])
+    def test_stock_list_fetch_api_blocks_ipv6_metadata_endpoint(
+        self,
+        _mock_parse_yaml,
+        mock_urlopen,
+        _mock_setup_env,
+    ) -> None:
+        with patch.dict(
+            os.environ,
+            {
+                "STOCK_LIST": "000001,300750",
+                "STOCK_LIST_FETCH_API": "http://[fd00:ec2::254]/latest/meta-data",
+            },
+            clear=True,
+        ):
+            config = Config._load_from_env()
+
+        mock_urlopen.assert_not_called()
+        self.assertEqual(config.stock_list, ["000001", "300750"])
+
     @patch("src.config.setup_env")
     @patch("src.config.urllib.request.urlopen")
     @patch.object(Config, "_parse_litellm_yaml", return_value=[])
@@ -615,6 +637,38 @@ def test_stock_list_fetch_api_blocks_hostname_resolving_to_metadata_ip(
         mock_urlopen.assert_not_called()
         self.assertEqual(config.stock_list, ["000001", "300750"])
 
+    @patch("src.config.setup_env")
+    @patch("src.config.urllib.request.urlopen")
+    @patch.object(Config, "_parse_litellm_yaml", return_value=[])
+    def test_stock_list_fetch_api_blocks_hostname_resolving_to_ipv6_private_ip(
+        self,
+        _mock_parse_yaml,
+        mock_urlopen,
+        _mock_setup_env,
+    ) -> None:
+        self.mock_getaddrinfo.return_value = [
+            (
+                socket.AF_INET6,
+                socket.SOCK_STREAM,
+                socket.IPPROTO_TCP,
+                "",
+                ("fd00:ec2::254", 443),
+            )
+        ]
+
+        with patch.dict(
+            os.environ,
+            {
+                "STOCK_LIST": "000001,300750",
+                "STOCK_LIST_FETCH_API": "https://watchlist.example/stocks.json",
+            },
+            clear=True,
+        ):
+            config = Config._load_from_env()
+
+        mock_urlopen.assert_not_called()
+        self.assertEqual(config.stock_list, ["000001", "300750"])
+
     @patch("src.config.setup_env")
     @patch("src.config.urllib.request.urlopen")
     @patch.object(Config, "_parse_litellm_yaml", return_value=[])
@@ -644,6 +698,35 @@ def test_stock_list_fetch_api_blocks_metadata_redirect_before_reading_response(
         self.assertFalse(response.read_called)
         self.assertEqual(config.stock_list, ["000001", "300750"])
 
+    @patch("src.config.setup_env")
+    @patch("src.config.urllib.request.urlopen")
+    @patch.object(Config, "_parse_litellm_yaml", return_value=[])
+    def test_stock_list_fetch_api_blocks_ipv6_metadata_redirect_before_reading_response(
+        self,
+        _mock_parse_yaml,
+        mock_urlopen,
+        _mock_setup_env,
+    ) -> None:
+        response = _FakeUrlopenResponse(
+            '["600519"]',
+            final_url="http://[fd00:ec2::254]/latest/meta-data",
+        )
+        mock_urlopen.return_value = response
+
+        with patch.dict(
+            os.environ,
+            {
+                "STOCK_LIST": "000001,300750",
+                "STOCK_LIST_FETCH_API": "https://example.com/stocks.json",
+            },
+            clear=True,
+        ):
+            config = Config._load_from_env()
+
+        mock_urlopen.assert_called_once()
+        self.assertFalse(response.read_called)
+        self.assertEqual(config.stock_list, ["000001", "300750"])
+
     @patch("src.config.setup_env")
     @patch("src.config.urllib.request.urlopen")
     @patch.object(Config, "_parse_litellm_yaml", return_value=[])