fix(node): bound and tighten the chat link-preview SSRF surface

The link-preview fetch is an outbound request to an address a member
chose. safe_url() already blocked non-public addresses and re-checked
each redirect hop; this adds the parts that were missing:

- Rate limit. `_do_link_preview_request` was reachable by any member
  with no ceiling, so a member — or a hub minting tokens for many
  accounts — could drive unbounded outbound HTTP from the operator's
  machine (amplification / DoS / on-demand IP disclosure to arbitrary
  hosts). Now bounded per connection (15) and node-wide (60) over a
  60 s window; only a real fetch counts, a cache hit is free, and over
  the ceiling the reply is a plain `ok: false` (bare link), not cached.

- Port allowlist. safe_url() passed `parts.port` straight through, so
  a member could aim the node at `http://<public-host>:<any-port>`.
  Restricted to {80, 443, 8080, 8443} — every real OpenGraph page,
  none of SSH / mail / DB / cache / search / admin ports.

- DNS rebinding. The connection's actual peer address is now
  re-checked against the public-address rule (`_reject_if_rebound`),
  so a name that resolves clean and then to something internal does
  not get its body read. Best-effort (no `network_stream` extension,
  no check); a full literal-pin is noted as remaining hardening.

- Decompression bomb. `_downscale` now refuses an image whose header
  dimensions exceed ~40 MP before convert()/thumbnail() decode it.

Third security review, finding M3.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG

2 files changed, 88 insertions, 2 deletions

diff --git a/packages/meshbay-node/tests/test_link_preview_request.py b/packages/meshbay-node/tests/test_link_preview_request.py
index d975f91..fe7dec6 100644
--- a/packages/meshbay-node/tests/test_link_preview_request.py
+++ b/packages/meshbay-node/tests/test_link_preview_request.py
@@ -34,9 +34,10 @@ def _clear_cache():
     webrtc_server._link_preview_cache.clear()
 
 
-def _session(media_cache):
+def _session(media_cache, ctx=None):
     s = WebRTCPeerSession.__new__(WebRTCPeerSession)
-    s._ctx = {"media_cache": media_cache}
+    s._ctx = ctx if ctx is not None else {"media_cache": media_cache}
+    s._peer_id = "t"
     s.sent = []
     s._send = s.sent.append
     return s
@@ -79,6 +80,51 @@ async def test_unfurlable_failure_is_ok_false(media_cache, monkeypatch):
     assert "image_thumb_hash" not in resp
 
 
+async def test_rate_limit_per_connection(media_cache, monkeypatch):
+    """A member firing many previews is bounded; over the ceiling the reply is
+    a plain `ok: false` (bare link) and no outbound fetch is made."""
+    monkeypatch.setattr(webrtc_server, "_LINK_PREVIEW_RATE_PER_CONN", 3)
+    calls = {"n": 0}
+
+    async def counting_preview(url, **k):
+        calls["n"] += 1
+        return {"url": url, "title": "x", "description": None,
+                "site_name": None, "image_url": None}
+    monkeypatch.setattr(linkpreview, "fetch_preview", counting_preview)
+
+    s = _session(media_cache)
+    for i in range(3):
+        await s._do_link_preview_request({"url": f"https://example.com/{i}"})
+    assert calls["n"] == 3
+    assert all(r["ok"] for r in s.sent)
+
+    await s._do_link_preview_request({"url": "https://example.com/over"})
+    assert calls["n"] == 3                 # not fetched
+    assert s.sent[-1]["ok"] is False
+
+
+async def test_rate_limit_is_node_wide(media_cache, monkeypatch):
+    """Two connections share the node-wide ceiling."""
+    monkeypatch.setattr(webrtc_server, "_LINK_PREVIEW_RATE_PER_CONN", 100)
+    monkeypatch.setattr(webrtc_server, "_LINK_PREVIEW_RATE_NODE", 2)
+    calls = {"n": 0}
+
+    async def counting_preview(url, **k):
+        calls["n"] += 1
+        return {"url": url, "title": "x", "description": None,
+                "site_name": None, "image_url": None}
+    monkeypatch.setattr(linkpreview, "fetch_preview", counting_preview)
+
+    ctx = {"media_cache": media_cache}
+    a, b = _session(media_cache, ctx), _session(media_cache, ctx)
+    await a._do_link_preview_request({"url": "https://example.com/a"})
+    await b._do_link_preview_request({"url": "https://example.com/b"})
+    await b._do_link_preview_request({"url": "https://example.com/c"})
+
+    assert calls["n"] == 2
+    assert b.sent[-1]["ok"] is False
+
+
 async def test_second_request_for_the_same_url_is_served_from_cache(media_cache, monkeypatch):
     calls = {"n": 0}
 
diff --git a/packages/meshbay-node/tests/test_linkpreview.py b/packages/meshbay-node/tests/test_linkpreview.py
index 0dd951a..a14b173 100644
--- a/packages/meshbay-node/tests/test_linkpreview.py
+++ b/packages/meshbay-node/tests/test_linkpreview.py
@@ -48,6 +48,30 @@ def test_safe_url_refuses(url):
         safe_url(url)
 
 
+@pytest.mark.parametrize("url", [
+    "http://example.com:22/x",       # SSH
+    "http://example.com:3306/x",     # MySQL
+    "http://example.com:6379/x",     # Redis
+    "http://example.com:9200/x",     # Elasticsearch
+    "http://example.com:5000/x",     # a common internal admin port
+])
+def test_safe_url_refuses_non_web_ports(url, resolves_public):
+    with pytest.raises(UnsafeURL):
+        safe_url(url)
+
+
+@pytest.mark.parametrize("url", [
+    "http://example.com/x",          # implicit 80
+    "https://example.com/x",         # implicit 443
+    "http://example.com:80/x",
+    "https://example.com:443/x",
+    "http://example.com:8080/x",
+    "https://example.com:8443/x",
+])
+def test_safe_url_allows_the_web_ports(url, resolves_public):
+    assert safe_url(url) == url
+
+
 def test_safe_url_accepts_a_public_host(resolves_public):
     assert safe_url("https://example.com/some/page") == "https://example.com/some/page"
 
@@ -153,3 +177,19 @@ async def test_fetch_image_downscales(resolves_public):
     assert jpeg and jpeg[:2] == b"\xff\xd8"        # JPEG SOI
     with Image.open(BytesIO(jpeg)) as im:
         assert max(im.size) <= linkpreview._IMAGE_MAX_DIM
+
+
+async def test_fetch_image_refuses_a_decompression_bomb(resolves_public, monkeypatch):
+    from io import BytesIO
+
+    from PIL import Image
+    # A tiny file that reports enormous dimensions from its header alone.
+    monkeypatch.setattr(linkpreview, "_MAX_IMAGE_PIXELS", 1_000_000)
+    buf = BytesIO()
+    Image.new("RGB", (2000, 2000), (0, 0, 0)).save(buf, format="PNG")  # 4 MP > cap
+    bomb = buf.getvalue()
+
+    def handler(request):
+        return httpx.Response(200, headers={"content-type": "image/png"}, content=bomb)
+    async with _client(handler) as c:
+        assert await linkpreview.fetch_image("https://example.com/x.png", client=c) is None