From f2fc02b636a6c44214aeddf5922ffdc6cfd21090 Mon Sep 17 00:00:00 2001
From: OpenClaw <gahr.coding@gmail.com>
Date: Fri, 10 Apr 2026 00:15:07 +0530
Subject: [PATCH] fix: use module-level BLOCKED_HOSTNAMES set and add
 metadata.internal

---
 gitnexus/src/server/git-clone.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gitnexus/src/server/git-clone.ts b/gitnexus/src/server/git-clone.ts
index 86f45b51f..0f7bc2653 100644
--- a/gitnexus/src/server/git-clone.ts
+++ b/gitnexus/src/server/git-clone.ts
@@ -25,6 +25,7 @@ export function getCloneDir(repoName: string): string {
 
 // Cloud metadata hostnames that must never be reachable via user-supplied URLs
 const BLOCKED_HOSTNAMES = new Set([
+  'localhost',
   'metadata.google.internal',
   'metadata.azure.com',
   'metadata.internal',
@@ -50,8 +51,7 @@ export function validateGitUrl(url: string): void {
   const host = parsed.hostname.toLowerCase();
 
   // Block known dangerous hostnames (cloud metadata services)
-  const blockedHostnames = ['localhost', 'metadata.google.internal', 'metadata.azure.com'];
-  if (blockedHostnames.includes(host)) {
+  if (BLOCKED_HOSTNAMES.has(host)) {
     throw new Error('Cloning from private/internal addresses is not allowed');
   }