Harden CardDAV credential and network boundaries

src/govoplan_addresses/backend/carddav.py

@@ -9,6 +9,12 @@ from dataclasses import dataclass, field
 from typing import Any, Mapping, Protocol
 
 from defusedxml import ElementTree as SafeElementTree
+from govoplan_core.security.outbound_http import (
+    OutboundHttpError,
+    bounded_response_bytes,
+    build_outbound_http_opener,
+    validate_outbound_http_url,
+)
 
 
 class AddressCardDAVError(RuntimeError):
@@ -326,20 +332,31 @@ class AddressCardDAVClient:
 def urllib_transport(method: str, url: str, headers: Mapping[str, str], body: bytes | None, timeout: int) -> tuple[int, Mapping[str, str], bytes]:
     url = validate_http_url(url)
     try:
+        url = validate_outbound_http_url(url, label="CardDAV URL")
         request = urllib.request.Request(  # noqa: S310 - URL is validated and origin-confined.
             url,
             data=body,
             headers=dict(headers),
             method=method,
         )
-        opener = urllib.request.build_opener(_SameOriginRedirectHandler(url))
+        opener = build_outbound_http_opener(_SameOriginRedirectHandler(url))
         with opener.open(request, timeout=timeout) as response:  # noqa: S310 - validated CardDAV URL; redirects remain on origin.  # nosec B310
-            return response.status, dict(response.headers.items()), response.read()
+            response_headers = dict(response.headers.items())
+            return response.status, response_headers, bounded_response_bytes(
+                response,
+                headers=response_headers,
+                label="CardDAV response",
+            )
     except urllib.error.HTTPError as exc:
-        return exc.code, dict(exc.headers.items()), exc.read()
+        response_headers = dict(exc.headers.items())
+        try:
+            payload = bounded_response_bytes(exc, headers=response_headers, label="CardDAV error response")
+        except OutboundHttpError as policy_exc:
+            raise AddressCardDAVError(f"{method} {url} failed: {policy_exc}") from policy_exc
+        return exc.code, response_headers, payload
     except urllib.error.URLError as exc:
         raise AddressCardDAVError(f"{method} {url} failed: {exc.reason}") from exc
-    except ValueError as exc:
+    except (OutboundHttpError, ValueError) as exc:
         raise AddressCardDAVError(f"{method} {url} failed: {exc}") from exc
 
 
@@ -493,7 +510,8 @@ class _SameOriginRedirectHandler(urllib.request.HTTPRedirectHandler):
         del fp, msg, headers
         try:
             candidate = validate_http_url(newurl)
-        except AddressCardDAVError:
+            candidate = validate_outbound_http_url(candidate, label="CardDAV redirect URL")
+        except (AddressCardDAVError, OutboundHttpError):
             return None
         if _url_origin(urllib.parse.urlparse(candidate)) != self._source_origin:
             return None