fix(ddns): apply SSRF defense to webhook provider

GHSA-6x26-5727-rrm9: a low-privilege member could point a DDNS webhook
at internal or loopback hosts and the dashboard would dial them with the
unrestricted utils.HttpClient.

Extract the notification SSRF defenses (CIDR blocklist, IP-pin DialContext,
SNI preservation, redirect rejection) into reusable helpers in pkg/utils
(NewRestrictedHTTPClient / ResolveAllowedHTTPURL / buildRestrictedHTTPClient)
and route the DDNS webhook through the same path. Replace the notification
inline implementation with a thin wrapper to keep behaviour identical.

Side improvements collected by the refactor:
- prepareRequest now resolves DNS once and returns the paired client, so
  the dialer's pinned IP and the validated URL stay in sync (no more
  double resolution between prepareRequest and SetRecords).
- response body is drained and closed.
- HttpClient / HttpClientSkipTlsVerify are explicitly tagged unsafe for
  attacker-controlled URLs.

Tests cover: hermetic SNI preservation, redirect rejection, dial pin to
the vetted IP, the full blocked-CIDR list at the webhook entry point,
and the verifyTLS↔skipVerifyTLS inversion in the notification wrapper.

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

model/notification.go

@@ -1,14 +1,10 @@
 package model
 
 import (
-	"context"
-	"crypto/tls"
 	"errors"
 	"fmt"
 	"io"
-	"net"
 	"net/http"
-	"net/netip"
 	"net/url"
 	"strings"
 	"time"
@@ -29,35 +25,6 @@ const (
 	NotificationRequestMethodPOST
 )
 
-var errNotificationURLNotAllowed = errors.New("notification URL target is not allowed")
-
-var notificationBlockedCIDRs = mustParseNotificationCIDRs([]string{
-	"0.0.0.0/8",
-	"10.0.0.0/8",
-	"100.64.0.0/10",
-	"127.0.0.0/8",
-	"169.254.0.0/16",
-	"172.16.0.0/12",
-	"192.0.0.0/24",
-	"192.0.2.0/24",
-	"192.168.0.0/16",
-	"198.18.0.0/15",
-	"198.51.100.0/24",
-	"203.0.113.0/24",
-	"224.0.0.0/4",
-	"240.0.0.0/4",
-	"::/128",
-	"::1/128",
-	"::ffff:0:0/96",
-	"64:ff9b::/96",
-	"100::/64",
-	"2001::/23",
-	"2001:db8::/32",
-	"fc00::/7",
-	"fe80::/10",
-	"ff00::/8",
-})
-
 type NotificationServerBundle struct {
 	Notification *Notification
 	Server       *Server
@@ -191,105 +158,13 @@ func (ns *NotificationServerBundle) Send(message string) error {
 	return nil
 }
 
-func newNotificationHTTPClient(rawURL string, verifyTLS bool) (*http.Client, error) {
-	parsedURL, ip, err := resolveNotificationTarget(rawURL)
-	if err != nil {
-		return nil, err
-	}
-
-	port := parsedURL.Port()
-	if port == "" {
-		if parsedURL.Scheme == "https" {
-			port = "443"
-		} else {
-			port = "80"
-		}
-	}
-	targetAddress := net.JoinHostPort(ip.String(), port)
-	dialer := &net.Dialer{}
-
-	return &http.Client{
-		Transport: &http.Transport{
-			DialContext: func(ctx context.Context, network, address string) (net.Conn, error) {
-				return dialer.DialContext(ctx, network, targetAddress)
-			},
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: !verifyTLS, ServerName: parsedURL.Hostname()},
-		},
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			return http.ErrUseLastResponse
-		},
-		Timeout: time.Minute * 10,
-	}, nil
-}
-
 func notificationResponseError(resp *http.Response) error {
 	_, _ = io.CopyN(io.Discard, resp.Body, 4096)
 	return fmt.Errorf("%d@%s", resp.StatusCode, resp.Status)
 }
 
-func resolveNotificationTarget(rawURL string) (*url.URL, net.IP, error) {
-	parsedURL, err := url.Parse(rawURL)
-	if err != nil {
-		return nil, nil, err
-	}
-	if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
-		return nil, nil, errNotificationURLNotAllowed
-	}
-
-	host := parsedURL.Hostname()
-	if host == "" {
-		return nil, nil, errNotificationURLNotAllowed
-	}
-	if ip := net.ParseIP(host); ip != nil {
-		if !notificationIPAllowed(ip) {
-			return nil, nil, errNotificationURLNotAllowed
-		}
-		return parsedURL, ip, nil
-	}
-
-	ips, err := net.LookupIP(host)
-	if err != nil {
-		return nil, nil, err
-	}
-	if len(ips) == 0 {
-		return nil, nil, errNotificationURLNotAllowed
-	}
-	for _, ip := range ips {
-		if !notificationIPAllowed(ip) {
-			return nil, nil, errNotificationURLNotAllowed
-		}
-	}
-
-	return parsedURL, ips[0], nil
-}
-
-func notificationIPAllowed(ip net.IP) bool {
-	parsedIP, ok := netipFromIP(ip)
-	if !ok {
-		return false
-	}
-	for _, cidr := range notificationBlockedCIDRs {
-		if cidr.Contains(parsedIP) {
-			return false
-		}
-	}
-	return parsedIP.IsGlobalUnicast()
-}
-
-func netipFromIP(ip net.IP) (netip.Addr, bool) {
-	parsedIP, ok := netip.AddrFromSlice(ip)
-	if !ok {
-		return netip.Addr{}, false
-	}
-	return parsedIP.Unmap(), true
-}
-
-func mustParseNotificationCIDRs(cidrs []string) []netip.Prefix {
-	prefixes := make([]netip.Prefix, 0, len(cidrs))
-	for _, cidr := range cidrs {
-		prefixes = append(prefixes, netip.MustParsePrefix(cidr))
-	}
-	return prefixes
+func newNotificationHTTPClient(rawURL string, verifyTLS bool) (*http.Client, error) {
+	return utils.NewRestrictedHTTPClient(rawURL, !verifyTLS)
 }
 
 // replaceParamInString 替换字符串中的占位符