Block connector limited-broadcast targets

src/govoplan_core/security/outbound_http.py

@@ -17,6 +17,7 @@ DEFAULT_FILE_TRANSFER_BYTES: Final = 512 * 1024 * 1024
 _READ_CHUNK_BYTES: Final = 64 * 1024
 _TRUE_VALUES: Final = frozenset({"1", "true", "yes", "on"})
 _FALSE_VALUES: Final = frozenset({"0", "false", "no", "off"})
+_IPV4_LIMITED_BROADCAST: Final = ipaddress.IPv4Address("255.255.255.255")
 
 
 class OutboundHttpError(RuntimeError):
@@ -298,7 +299,12 @@ def _is_forbidden_special_address(value: str) -> bool:
     mapped = getattr(address, "ipv4_mapped", None)
     if mapped is not None:
         address = mapped
-    return address.is_link_local or address.is_multicast or address.is_unspecified
+    return (
+        address == _IPV4_LIMITED_BROADCAST
+        or address.is_link_local
+        or address.is_multicast
+        or address.is_unspecified
+    )
 
 
 def _resolved_address_records(