fix(onebot): tighten inbound media download handling

pkg/tools/integration/web.go

@@ -2324,16 +2324,6 @@ func newPrivateHostWhitelist(entries []string) (*utils.PrivateHostWhitelist, err
 	return utils.NewPrivateHostWhitelist(entries)
 }
 
-func isObviousPrivateHost(host string, whitelist *utils.PrivateHostWhitelist) bool {
-	return utils.IsObviousPrivateHost(host, whitelist, func() bool {
-		return allowPrivateWebFetchHosts.Load()
-	})
-}
-
 func isPrivateOrRestrictedIP(ip net.IP) bool {
 	return utils.IsPrivateOrRestrictedIP(ip)
 }
-
-func allowConfiguredProxyFirstHop(req *http.Request, rt http.RoundTripper) {
-	utils.AllowConfiguredProxyFirstHop(req, rt)
-}

pkg/utils/http_guard_test.go

@@ -60,7 +60,10 @@ func TestCreateSafeHTTPClient_BlocksPrivateRedirect(t *testing.T) {
 	}
 
 	allowPrivateHosts = false
-	_, err = client.Get(server.URL)
+	resp, err := client.Get(server.URL)
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
 	if err == nil {
 		t.Fatal("expected redirect to private host to fail")
 	}

pkg/utils/media.go

@@ -97,9 +97,10 @@ func DownloadFile(urlStr, filename string, opts DownloadOptions) string {
 	var client *http.Client
 	var err error
 	if opts.BlockPrivateTargets {
-		if err := ValidateSafeHTTPURL(urlStr, nil, nil); err != nil {
+		validateErr := ValidateSafeHTTPURL(urlStr, nil, nil)
+		if validateErr != nil {
 			logger.ErrorCF(opts.LoggerPrefix, "Blocked unsafe download URL", map[string]any{
-				"error": err.Error(),
+				"error": validateErr.Error(),
 				"url":   urlStr,
 			})
 			return ""