Security: disallow blind SSRF to link-local IPs via URL unfurling

lib/restricted_http/private_network_guard.rb

@@ -16,7 +16,7 @@ module RestrictedHTTP
 
     def private_ip?(ip)
       IPAddr.new(ip).then do |ipaddr|
-        ipaddr.private? || ipaddr.loopback? || LOCAL_IP.include?(ipaddr)
+        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? || LOCAL_IP.include?(ipaddr)
       end
     rescue IPAddr::InvalidAddressError
       true

test/models/opengraph/location_test.rb

@@ -21,6 +21,14 @@ class Opengraph::LocationTest < ActiveSupport::TestCase
     assert_equal [ "is not public" ], location.errors[:url]
   end
 
+  test "link-local addresses are blocked" do
+    Resolv.stubs(:getaddress).with("metadata.internal").returns("169.254.169.254")
+
+    location = Opengraph::Location.new("https://metadata.internal")
+    assert_not location.valid?
+    assert_equal [ "is not public" ], location.errors[:url]
+  end
+
   test "avoid reading file urls when expecting HTML" do
     large_file = Opengraph::Location.new("https://www.example.com/100gb.zip")