fix(chromium): route loopback WebSockets through the pinning proxy when an outbound policy is set

test/integration/features/chromium_convert_html.feature

@@ -521,6 +521,22 @@ Feature: /forms/chromium/convert/html
       | 'wss://127.0.0.1:9999/wss-test' targets a non-public address |
       | CONNECT blocked for '127.0.0.1:9999'                         |
 
+  # An allow-list is enforced on its own, without the IP-class flags. Chromium
+  # skips the proxy for loopback and link-local destinations unless told
+  # otherwise, so a WebSocket the allow-list rejects must still reach the
+  # pinning proxy to be severed.
+  @chromium-ssrf
+  Scenario: POST /forms/chromium/convert/html (WebSocket not in the allow-list is filtered)
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST | ^file:///tmp/.* |
+    When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
+      | files     | testdata/ssrf-websocket-html/index.html | file  |
+      | waitDelay | 1s                                      | field |
+    Then the response status code should be 200
+    Then the Gotenberg container should log the following entries:
+      | 'ws://127.0.0.1:9999/ssrf-websocket' does not match any expression from the allowed list |
+      | CONNECT blocked for '127.0.0.1:9999'                                                     |
+
   # EventSource issues an ordinary HTTP GET, so unlike a WebSocket it IS surfaced
   # as a fetch.EventRequestPaused and blocked by listenForEventRequestPaused.
   @chromium-ssrf
@@ -629,7 +645,10 @@ Feature: /forms/chromium/convert/html
     Then there should be 1 PDF(s) in the response
 
   Scenario: POST /forms/chromium/convert/html (Fail On Resource Loading Failed)
-    Given I have a default Gotenberg container
+    # A configured allow-list routes loopback through the pinning proxy, which
+    # reports a refused connection as a 502 response, not a loading failure.
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST |  |
     When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/html" endpoint with the following form data and header(s):
       | files                       | testdata/feature-rich-html/index.html | file  |
       | failOnResourceLoadingFailed | true                                  | field |

test/integration/features/chromium_convert_markdown.feature

@@ -410,7 +410,10 @@ Feature: /forms/chromium/convert/markdown
       """
 
   Scenario: POST /forms/chromium/convert/markdown (Fail On Resource Loading Failed)
-    Given I have a default Gotenberg container
+    # A configured allow-list routes loopback through the pinning proxy, which
+    # reports a refused connection as a 502 response, not a loading failure.
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST |  |
     When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/markdown" endpoint with the following form data and header(s):
       | files                       | testdata/feature-rich-markdown/index.html | file  |
       | files                       | testdata/feature-rich-markdown/table.md   | file  |

test/integration/features/chromium_convert_url.feature

@@ -711,7 +711,10 @@ Feature: /forms/chromium/convert/url
       """
 
   Scenario: POST /forms/chromium/convert/url (Fail On Resource Loading Failed)
-    Given I have a default Gotenberg container
+    # A configured allow-list routes loopback through the pinning proxy, which
+    # reports a refused connection as a 502 response, not a loading failure.
+    Given I have a Gotenberg container with the following environment variable(s):
+      | CHROMIUM_ALLOW_LIST |  |
     Given I have a static server
     When I make a "POST" request to Gotenberg at the "/forms/chromium/convert/url" endpoint with the following form data and header(s):
       | url                         | http://host.docker.internal:%d/html/testdata/feature-rich-html-remote/index.html | field |