fix(bluebubbles): auto-allowlist serverUrl hostname in SSRF policy - #27648

Greptile Summary

Auto-allowlists the configured BlueBubbles serverUrl hostname in the SSRF policy when fetching attachments, so localhost and private-IP setups work out of the box without requiring explicit allowPrivateNetwork config.

• When allowPrivateNetwork is not explicitly set, the hostname from the constructed API URL is extracted and passed as allowedHostnames in the SSRF policy, which is more targeted than blanket allowPrivateNetwork: true
• The SSRF guard still enforces redirect-chain checks, so a malicious redirect from the configured server to a different private IP would still be blocked
• Existing allowPrivateNetwork: true behavior is preserved as the higher-precedence explicit opt-in
• Test coverage added for both localhost and private IP (192.168.1.5) scenarios

Confidence Score: 5/5

• This PR is safe to merge — it applies a targeted SSRF allowlist scoped to the user's own configured server hostname, with no blanket private network bypass.
• The change is minimal and well-scoped: a single helper function and a ternary branch update. The security implications are positive — it uses allowedHostnames (which only bypasses private-network checks for the specific hostname) rather than allowPrivateNetwork: true (which blanket-allows all private addresses). The SSRF guard still enforces redirect-chain checks. Tests cover localhost, private IP, and explicit allowPrivateNetwork precedence cases.
• No files require special attention.

_{Last reviewed commit: 263cf03}

Security review note:

I like the direction here (auto-allowlisting the configured BlueBubbles serverUrl hostname), and the added tests are clear.

Evidence I checked:

• Diff adds safeExtractHostname() and sets ssrfPolicy.allowedHostnames from parsed URL host.
• Tests now explicitly allowlist localhost and a private IP host.

Two hardening asks before merge:

1. Add edge-case tests for hostname canonicalization (localhost., mixed-case hostnames, IPv6 literals like [::1], malformed URLs with userinfo) so allowlisting cannot be bypassed via parse ambiguities.
2. Rebase and rerun full CI. Current PR state is CONFLICTING/DIRTY and visible checks are mostly label/auto-response, so we do not yet have full gate evidence on this head.

Landed on main via 7d9397099b901ec7ff8bbbbf6fc0a11bf981293c.

I carried over the same core fix and shipped it with:

• changelog entry + reporter thanks
• co-author trailer (Co-authored-by: damaozi <1811866786@qq.com>)

Closing this PR as already landed direct on main.