feat: add CIDR/subnet range support to restrictedAddresses

[tilak-patel-postman]

Adds support for restricting network requests by CIDR range (e.g. 10.0.0.0/8) in addition to the existing exact IP/host matches. Requests to any IP inside a restricted CIDR block are blocked, closing several SSRF bypasses around IPv6-embedded IPv4 and raw-IP redirects.

CIDR matching (lib/requester/core.js)

• isAddressRestricted now matches against CIDR entries using ipaddr.js, alongside the existing exact-match logic.
• CIDR entries are parsed from restrictedAddresses lazily on first call and cached on networkOptions (restrictedAddresses is treated as immutable after that). Invalid CIDR entries are skipped silently.
• Handles addresses that embed IPv4 inside IPv6 before matching: bracketed literals ([::1]), IPv4-mapped (::ffff:a.b.c.d), IPv4-compatible (::a.b.c.d), NAT64 (64:ff9b::/96, RFC 6052), IPv4-translated (::ffff:0:x, RFC 6145), and 6to4 (2002::/16, RFC 3056).

Redirect coverage

• Adds a bindOn.redirect listener so redirects to numeric hosts / bracketed IPv6 literals are checked — Node's DNS lookup hook is never invoked for those, so the override alone didn't cover redirect hops.
• The listener is idempotent: postman-request re-binds bindOn on every redirect hop, so it guards on _aborted to avoid emitting error more than once.
• *.localhost subdomains are blocked when any loopback address is restricted.

Dependency

• Adds ipaddr.js as a runtime dependency for IP/CIDR parsing and matching.

Tests

• Unit tests for isAddressRestricted covering exact matches, IPv4/IPv6 CIDR boundaries, mixed-family lists, all IPv6→IPv4 embeddings, leading-zero embedded IPv4, bracketed literals, lazy CIDR init, and invalid entries.
• Integration tests for CIDR blocking, raw-IP and bracketed-IPv6 redirect blocking, and the *.localhost fast-path.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.19%. Comparing base (d74e154) to head (5388fdc).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1548      +/-   ##
===========================================
+ Coverage    75.91%   76.19%   +0.27%     
===========================================
  Files           50       50              
  Lines         3974     4020      +46     
  Branches      1151     1172      +21     
===========================================
+ Hits          3017     3063      +46     
  Misses         721      721              
  Partials       236      236              

Flag	Coverage Δ
integration	67.23% <68.75%> (+<0.01%)	⬆️
legacy	35.64% <2.08%> (-0.39%)	⬇️
unit	44.00% <89.58%> (+0.59%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.