Fix ssrf validation

[whitesquirrell]

Summary

This pull request addresses a potential Server-Side Request Forgery (SSRF) vulnerability in the EditDomainForm.clean() method.

Details

Currently, the form accepts arbitrary nameserver_ip inputs, which are passed to the check_domain() function. This leads to dynamic DNS update attempts to the specified IP address, including internal ones (e.g., 127.0.0.1). As a result, attackers could potentially:

• Probe internal network services
• Interact with unintended internal DNS servers
• Perform SSRF attacks using the application's backend

Fix

This patch adds validation using Python’s ipaddress module to reject loopback, private, and reserved IP addresses before performing any DNS update.

Impact

This prevents misuse of the DNS update mechanism and mitigates the risk of SSRF attacks via internal IP injection.

[ThomasWaldmann]

Guess the boundary between SSRF and potentially desired functionality is a bit unclear here:

• the dns server that shall be updated as desired part of an nsupdate.info setup could be installed on the same host (accessed via localhost) or same local network (and accessed via some local network IP). it having a public IP is not a requirement.
• whether or not dynamic updates shall be accepted on the dns server is decided by the dns server using authentication (via a shared secret).