fix(chromium): filter WebSocket handshakes against the outbound policy

test/integration/testdata/ssrf-eventsource-html/index.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>EventSource SSRF</title>
+  </head>
+  <body>
+    <h1>EventSource SSRF</h1>
+    <script type="application/javascript">
+      // EventSource issues an ordinary HTTP GET, so it is surfaced as a
+      // Fetch.requestPaused event and blocked by the outbound filter.
+      new EventSource("http://127.0.0.1:9999/sse");
+    </script>
+  </body>
+</html>

test/integration/testdata/ssrf-fetch-html/index.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Fetch SSRF Control</title>
+  </head>
+  <body>
+    <h1>Fetch SSRF Control</h1>
+    <script type="application/javascript">
+      // Control: an ordinary fetch to a loopback address IS surfaced as a
+      // Fetch.requestPaused event and blocked by CHROMIUM_DENY_PRIVATE_IPS.
+      fetch("http://127.0.0.1:9999/ssrf-fetch").catch(() => {});
+    </script>
+  </body>
+</html>

test/integration/testdata/ssrf-websocket-html/index.html

@@ -0,0 +1,20 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>WebSocket SSRF</title>
+  </head>
+  <body>
+    <h1>WebSocket SSRF</h1>
+    <script type="application/javascript">
+      // Both targets resolve to non-public addresses, so CHROMIUM_DENY_PRIVATE_IPS
+      // must block them. Unlike fetch/XHR/sub-resources, a WebSocket handshake is
+      // never surfaced as a Fetch.requestPaused event, so it currently escapes the
+      // outbound filter entirely.
+      //   127.0.0.1       -> loopback
+      //   169.254.169.254 -> link-local (cloud metadata)
+      new WebSocket("ws://127.0.0.1:9999/ssrf-websocket");
+      new WebSocket("ws://169.254.169.254:80/ssrf-websocket");
+    </script>
+  </body>
+</html>

test/integration/testdata/ssrf-websocket-tls-html/index.html

@@ -0,0 +1,15 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>WSS SSRF</title>
+  </head>
+  <body>
+    <h1>WSS SSRF</h1>
+    <script type="application/javascript">
+      // wss:// (TLS) handshakes tunnel through the proxy via CONNECT, the same
+      // path as ws://, and must be filtered identically.
+      new WebSocket("wss://127.0.0.1:9999/wss-test");
+    </script>
+  </body>
+</html>

test/integration/testdata/ssrf-websocket-worker-html/index.html

@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Worker WebSocket SSRF</title>
+  </head>
+  <body>
+    <h1>Worker WebSocket SSRF</h1>
+    <script type="application/javascript">
+      // A Web Worker is a separate CDP target, so its WebSocket handshake is
+      // not observed by listenForEventWebSocketCreated (which listens on the
+      // page target). Enforcement must therefore not rely on that listener:
+      // the pinning proxy sees every handshake regardless of the originating
+      // context and severs the connection.
+      const source =
+        'new WebSocket("ws://127.0.0.1:9999/ws-from-worker");' +
+        'new WebSocket("ws://169.254.169.254:80/ws-from-worker-metadata");';
+      const blob = new Blob([source], { type: "application/javascript" });
+      new Worker(URL.createObjectURL(blob));
+    </script>
+  </body>
+</html>