test: add regression coverage for proxy hostname parser differentials

[zredlined]

Description

Add regression tests that exercise hostname parser/canonicalization edge cases at the sandbox proxy boundary. This is inspired by the Claude Code SOCKS5 NUL-byte allowlist bypass documented here:

https://oddguan.com/blog/second-time-same-sandbox-anthropic-claude-code-network-allowlist-bypass-data-exfiltration/#the-disclosure-experience

Context

The core class is a parser differential: policy matching approves one hostname representation while the resolver/connect path dials a different destination. OpenShell does not appear to share the specific SOCKS5 NUL-byte issue, but the class is worth pinning down in tests.

Definition of Done

• Add focused regression coverage for malformed CONNECT hostnames, including NUL/control characters and encoded variants.
• Include wildcard policy cases so policy matching and resolution are exercised together.
• Confirm internal-IP/SSRF checks still fail closed for malformed or ambiguous destinations.

[zredlined]

🏗️ build-plan

Implementation Plan

Issue type: chore
Complexity: Low
Confidence: High — clear path

Summary

Add focused regression tests for hostname parser/canonicalization edge cases in the sandbox proxy path. The tests should document the parser-differential class from the referenced Claude Code SOCKS5 NUL-byte bypass and verify OpenShell continues to fail closed across policy matching, wildcard hosts, DNS resolution, and SSRF/internal-IP checks.

Scope

• crates/openshell-sandbox/src/proxy.rs: add unit tests around CONNECT target parsing and resolver/SSRF helper behavior for malformed or ambiguous hostnames.
• crates/openshell-sandbox/src/opa.rs: add or extend wildcard-host policy tests for NUL/control/encoded-style hostname inputs, ensuring policy matching does not create an unintended allow path.

Implementation Steps

1. Add parser-focused unit tests for CONNECT targets containing NUL/control characters, percent-encoded NUL-like input, empty hosts, and oversized hosts.
2. Add wildcard policy tests that exercise malformed hostname inputs against *.example.com style rules.
3. Add resolver/SSRF helper assertions that malformed or ambiguous destinations fail before an upstream connection can be established.
4. Keep the implementation test-only unless the tests reveal a concrete fail-open behavior that requires a small validation fix.

Test Plan

• Unit tests: cargo test -p openshell-sandbox <focused filters> --lib covering proxy parser, OPA wildcard matching, and resolver/SSRF behavior.
• Integration tests: N/A — this is regression coverage for existing module boundaries.
• E2E tests: N/A — no sandbox infrastructure or user workflow changes expected.

Risks & Open Questions

• If a test exposes permissive behavior in parse_target, decide whether to make this issue include the small fail-closed validation fix or split that into a separate fix ticket. Given the security context, a minimal validation fix would likely be appropriate if needed.

Documentation Impact

• None expected. This is internal regression coverage; no user-facing behavior change is intended unless a validation gap is found.

---

Revision 1 — initial plan

[johntmyers]

gator-agent

Validated

This issue is valid for OpenShell because it is a focused sandbox security/testing item with maintainer-authored scope and an active linked PR (#1562).

Recommended next step: track the linked PR through review and CI.

[github-actions]

This issue has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. Comment or remove the state:stale label to keep it open.