jif 37eaae6eeb Require hostname authorization before proxy DNS lookups (#51650) ...

## Why

Resolving unapproved hostnames discloses them to DNS even when the proxy ultimately rejects the request. Allowing local binding in a managed macOS sandbox also granted direct outbound access to port `53`.

## What changed

- Require an allowlist match or policy approval before resolving a hostname for address checks.
- Recheck baseline restrictions after local and remote policy approval so approval cannot bypass explicit denies or local/private address restrictions.
- Preserve DNS checks for inner HTTPS requests after an approved CONNECT, including hosts without a persisted allowlist entry.
- Remove the Seatbelt allowance for external DNS while retaining local binding and loopback proxy access.

## Testing

Add regression tests for zero DNS lookups on unapproved hosts, private-address rejection after approval, local and remote approval ordering, and DNS checks after approved CONNECT requests. Add a macOS Seatbelt child test that verifies external UDP and TCP port `53` access is denied while local binding and proxy connectivity remain available.

GitOrigin-RevId: 490790462c51928e831dd8375ac098bc3a257bac

2026-10-07 11:10:20 +00:00

..

src

Require hostname authorization before proxy DNS lookups (#51650)

2026-10-07 11:10:20 +00:00

BUILD.bazel

Rename the read-only Seatbelt platform defaults policy (#41449)

2026-08-29 02:49:33 +00:00

Cargo.toml

Use descriptor-safe helpers for executable test fixtures (#50018)

2026-10-01 15:57:03 +00:00