fix(engine): block future-use IPv4 downloads

packages/engine/src/utils/urlDownloader.test.ts

@@ -109,6 +109,8 @@ describe("assertPublicHttpsUrl — SSRF guard", () => {
       "https://198.18.0.1/secret",
       "https://192.0.2.1/secret",
       "https://224.0.0.1/secret",
+      "https://240.0.0.1/secret",
+      "https://255.255.255.255/secret",
     ]) {
       expect(() => assertPublicHttpsUrl(url), url).toThrow("private/reserved");
     }

packages/engine/src/utils/urlDownloader.ts

@@ -114,6 +114,7 @@ for (const [network, prefix] of [
   ["198.51.100.0", 24],
   ["203.0.113.0", 24],
   ["224.0.0.0", 4],
+  ["240.0.0.0", 4],
 ] as const) {
   NON_PUBLIC_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4");
 }