From 2a80f7643211c4e5e781bac4f9d9dfc5a8896df4 Mon Sep 17 00:00:00 2001
From: Stacy Olivas <kg7qin@arrl.net>
Date: Fri, 10 Apr 2026 05:17:44 -0700
Subject: [PATCH] sync: use explicit CGN network check in validate_external_url
 (from PR #140)

Replace is_global fallback with canonical _CGN_NETWORK constant check to
stay consistent with PR #140's approach across all post-140 branches.
---
 modules/security_utils.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/modules/security_utils.py b/modules/security_utils.py
index 1ab982a..7c853d2 100644
--- a/modules/security_utils.py
+++ b/modules/security_utils.py
@@ -111,10 +111,12 @@ def validate_external_url(
                     logger.warning(f"URL resolves to private/internal IP: {ip}")
                     return False
 
+                # Reject CGN (Carrier-Grade NAT) - RFC 6598
                 if ip_obj in _CGN_NETWORK:
                     logger.warning(f"URL resolves to CGN IP: {ip}")
                     return False
 
+                # Reject reserved ranges
                 if ip_obj.is_reserved or ip_obj.is_multicast:
                     logger.warning(f"URL resolves to reserved/multicast IP: {ip}")
                     return False