From 8f34fc5ee553ad3d019d32f6e393a3576b2bf276 Mon Sep 17 00:00:00 2001
From: Abhinav Raut <abhinavrautcs@gmail.com>
Date: Sat, 18 Jul 2026 11:40:12 +0530
Subject: [PATCH] guard against a replaced http.DefaultTransport in
 ssrf.NewTransport

Type-asserting http.DefaultTransport.(*http.Transport) panics if a dependency swaps the global for a different RoundTripper. Fall back to a fresh transport with the standard defaults so boot can't crash.
---
 internal/ssrf/ssrf.go | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/internal/ssrf/ssrf.go b/internal/ssrf/ssrf.go
index 2538c31d..6ee53ba5 100644
--- a/internal/ssrf/ssrf.go
+++ b/internal/ssrf/ssrf.go
@@ -40,7 +40,18 @@ func NewControl(enabled bool, allowedCIDRs []string, lo *logf.Logger) Control {
 
 // NewTransport clones http.DefaultTransport (keeping proxy and connection-pool defaults) and applies the SSRF dial guard; callers may override the returned transport's timeouts.
 func NewTransport(control Control, dialTimeout time.Duration) *http.Transport {
-	t := http.DefaultTransport.(*http.Transport).Clone()
+	base, ok := http.DefaultTransport.(*http.Transport)
+	if !ok {
+		base = &http.Transport{
+			Proxy:                 http.ProxyFromEnvironment,
+			ForceAttemptHTTP2:     true,
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+		}
+	}
+	t := base.Clone()
 	t.DialContext = (&net.Dialer{
 		Timeout:   dialTimeout,
 		KeepAlive: 30 * time.Second,