fix(media): constrain attachment redirects

CHANGELOG.md

@@ -11,6 +11,7 @@
 - Show setup guidance instead of a raw missing-file error when configuration-dependent commands cannot find `config.toml`. Thanks @0xdevalias.
 - Report module build metadata for source-installed binaries instead of a stale hard-coded release version.
 - Keep Discord Gateway tails fail-closed while durably spooling and replaying timed-out message creates, updates, and deletes. Thanks @hannesrudolph.
+- Reject attachment redirects whose final URL leaves Discord's allowlisted CDN hosts. Thanks @GrantTheAssistant.
 
 ## 0.11.5 - 2026-07-09
 

internal/media/cache.go

@@ -50,9 +50,7 @@ func Fetch(ctx context.Context, s *store.Store, opts FetchOptions) (FetchStats,
 	if opts.MaxBytes <= 0 {
 		opts.MaxBytes = DefaultMaxBytes
 	}
-	if opts.HTTPClient == nil {
-		opts.HTTPClient = &http.Client{Timeout: 30 * time.Second}
-	}
+	opts.HTTPClient = attachmentHTTPClient(opts.HTTPClient)
 	if opts.Now == nil {
 		opts.Now = time.Now
 	}
@@ -133,6 +131,29 @@ func Fetch(ctx context.Context, s *store.Store, opts FetchOptions) (FetchStats,
 	return stats, nil
 }
 
+func attachmentHTTPClient(client *http.Client) *http.Client {
+	if client == nil {
+		client = &http.Client{Timeout: 30 * time.Second}
+	}
+	clone := *client
+	previous := clone.CheckRedirect
+	clone.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+		if len(via) >= 3 || !isAllowedAttachmentURL(req.URL.String()) {
+			return errors.New("attachment redirect denied")
+		}
+		if previous != nil {
+			if err := previous(req, via); err != nil {
+				return err
+			}
+			if !isAllowedAttachmentURL(req.URL.String()) {
+				return errors.New("attachment redirect denied")
+			}
+		}
+		return nil
+	}
+	return &clone
+}
+
 func attachmentFailureRef(attachment store.AttachmentRow) store.FailureRef {
 	return store.FailureRef{
 		Operation:   "fetch_attachment",
@@ -234,6 +255,11 @@ func fetchURL(ctx context.Context, opts FetchOptions, attachment store.Attachmen
 		}
 	}
 	defer func() { _ = resp.Body.Close() }()
+	// Injected clients can supply their own redirect policy, so validate the
+	// final response URL at the fetch boundary as well.
+	if resp.Request == nil || resp.Request.URL == nil || !isAllowedAttachmentURL(resp.Request.URL.String()) {
+		return fetchResult{}, errors.New("attachment response URL denied")
+	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
 		return fetchResult{}, fmt.Errorf("attachment fetch returned HTTP %d", resp.StatusCode)
 	}

internal/media/cache_test.go

@@ -8,9 +8,11 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -470,6 +472,60 @@ func TestMediaPathHelpers(t *testing.T) {
 	require.False(t, isAllowedAttachmentURL("https://user@cdn.discordapp.com/attachments/c/file.png"))
 }
 
+func TestFetchURLRejectsAllowedCDNRedirectToMetadataHost(t *testing.T) {
+	t.Parallel()
+	var calls atomic.Int32
+	client := attachmentHTTPClient(&http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		calls.Add(1)
+		headers := make(http.Header)
+		headers.Set("Location", "http://169.254.169.254/computeMetadata/v1/")
+		return &http.Response{
+			StatusCode: http.StatusFound,
+			Header:     headers,
+			Body:       io.NopCloser(strings.NewReader("redirect")),
+			Request:    req,
+		}, nil
+	})})
+	request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "https://cdn.discordapp.com/attachments/c/x.txt", nil)
+	require.NoError(t, err)
+	response, err := client.Do(request)
+	if response != nil {
+		_ = response.Body.Close()
+	}
+	require.ErrorContains(t, err, "attachment redirect denied")
+	require.EqualValues(t, 1, calls.Load())
+}
+
+func TestAttachmentHTTPClientRejectsRedirectCallbackURLMutation(t *testing.T) {
+	t.Parallel()
+	var calls atomic.Int32
+	client := attachmentHTTPClient(&http.Client{
+		Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
+			calls.Add(1)
+			headers := make(http.Header)
+			headers.Set("Location", "https://media.discordapp.net/attachments/c/next.txt")
+			return &http.Response{
+				StatusCode: http.StatusFound,
+				Header:     headers,
+				Body:       io.NopCloser(strings.NewReader("redirect")),
+				Request:    req,
+			}, nil
+		}),
+		CheckRedirect: func(req *http.Request, _ []*http.Request) error {
+			req.URL = &url.URL{Scheme: "http", Host: "169.254.169.254", Path: "/computeMetadata/v1/"}
+			return nil
+		},
+	})
+	request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "https://cdn.discordapp.com/attachments/c/x.txt", nil)
+	require.NoError(t, err)
+	response, err := client.Do(request)
+	if response != nil {
+		_ = response.Body.Close()
+	}
+	require.ErrorContains(t, err, "attachment redirect denied")
+	require.EqualValues(t, 1, calls.Load())
+}
+
 func TestMediaTargetNeedsWrite(t *testing.T) {
 	t.Parallel()