Harden external file connector boundaries

tests/test_connector_providers.py

@@ -4,7 +4,7 @@ import unittest
 from datetime import UTC, datetime
 from unittest.mock import patch
 
-from govoplan_files.backend.storage.connector_browse import browse_connector_profile
+from govoplan_files.backend.storage.connector_browse import _smb_location, browse_connector_profile
 from govoplan_files.backend.storage.connector_browse import ConnectorBrowseUnsupported
 from govoplan_files.backend.storage.connector_imports import read_connector_file
 from govoplan_files.backend.storage.connector_profiles import ConnectorProfile, connector_profiles_from_payload
@@ -76,6 +76,24 @@ def s3_profile(**overrides: object) -> ConnectorProfile:
 
 
 class ConnectorProviderTests(unittest.TestCase):
+    def test_smb_uses_validated_numeric_target_when_private_networks_are_disabled(self) -> None:
+        profile = ConnectorProfile(
+            id="public-smb",
+            label="Public SMB",
+            provider="smb",
+            endpoint_url="smb://files.example.test/share",
+        )
+        with patch.dict(
+            "os.environ",
+            {"APP_ENV": "production", "GOVOPLAN_CONNECTOR_ALLOW_PRIVATE_NETWORKS": "false"},
+        ), patch(
+            "govoplan_core.security.outbound_http.socket.getaddrinfo",
+            return_value=[(2, 1, 6, "", ("93.184.216.34", 445))],
+        ):
+            location = _smb_location(profile)
+
+        self.assertEqual("93.184.216.34", location.server)
+
     def test_provider_descriptors_include_s3_and_reserved_microsoft_providers(self) -> None:
         descriptors = {descriptor.provider: descriptor for descriptor in connector_provider_descriptors()}