searxng 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 312181892379c3ed0181f46a10f535e96803969d7f1b224b87e07fe7fe2d68d4
-  data.tar.gz: e206771ab2279dac1329a08dc1195d254e5992c4532c7e2e5afd95a67b267991
+  metadata.gz: 0752ce85481fa3a6a5846b4326effa0251ff69e77a32912dc046f06e35542832
+  data.tar.gz: 1700a1ad55569d5cbb7137c6b3c6cde6583c8b6198508975e6b66030dfd2bc39
 SHA512:
-  metadata.gz: ce7b9acd2231550ddd32fd27956b1ef366f044a769f7b0034a6f5c5ade98efed0ac96a34856d1015456cc46132b024afb723726117dd3a9df7b82b26282d5ad7
-  data.tar.gz: 5636c48dd7221654b182793931ffb097fe017939fe8fc41781819deda7ed627a921edf508243f16943fa70ade77ee04b59b3ea6ed6be76de63eb34becbe2e13c
+  metadata.gz: e85f85f3363f0468cef0d8dd6b5318f2d2eba8ef7268e6c607fbbe318a5140347e395400b747c33716f4ee73a2fa99e6af54398e7e20e42dbfb2e1a76f60593a
+  data.tar.gz: ff609005b3e6993106c5c29855801675e48b25221456d7f4561f43390a31af1002d98a6abc718d407cd3c87bcede1ff8bed6b587cf166c6fdd5dddfb699aa3a8

data/CHANGELOG.md

@@ -1,7 +1,26 @@
-# Changelog
+# CHANGELOG
 
 ## Unreleased
 
+## 0.2.1 (2026-10-29)
+
+- Fix cleartext HTTP proxy fetches to dial the `NetworkPolicy`-pinned IP and set `Host` to the original hostname.
+- Fix unbounded `web_url_read` response buffering with a shared byte ceiling across HTTP, FTP, SFTP, SMB, and Gemini.
+- Fix process-wide `@@url_cache` growth with TTL purge, entry cap, byte budget, and a mutex.
+- Fix Gemini TLS verification by loading the default CA store via `SSLContext#set_params`.
+- Fix SMB credentials leaking through `smbclient` argv; pass the password via `PASSWD`.
+- Fix website HTTP errors mislabeled as SearXNG search failures; include redirect `Location` when present.
+- Fix invalid `time_range` / `safesearch` values being silently dropped; raise `ConfigurationError`.
+- Fix IPFS gateway path traversal via unsafe CID or `..` path segments.
+- Fix `timeoutMs` of `0` disabling deadlines; clamp to `1000..30000`.
+- Fix release gate ignoring lint/test failures (`pipefail`) and dirty staged/untracked trees.
+- Fix release confirmation treating EOF as publish; require an explicit Enter for the default.
+- Require a `CHANGELOG.md` version heading matching `VERSION` before gem push.
+- Fix `searxng serve` swallowing startup errors into an unbounded `StringIO`; reopen stderr to `File::NULL` and print configuration failures.
+- Add `NetworkPolicy` coverage for local NAT64 (`64:ff9b:1::/48`), IPv4-compatible embeds, documentation ranges, and bracketed IPv6 hostnames via `uri.hostname`.
+- Document Ruby `>= 3.4` and that `.onion` / `.i2p` are not supported by `web_url_read`.
+- Redact URL userinfo from fetch error URIs; default `maxLength` to `20000`; honor `SEARXNG_USER_AGENT` for URL reads.
+
 ## 0.2.0
 
 - MCP: Added `web_url_read` tool (URL fetch + Markdown conversion with pagination/section options).

data/README.md

@@ -1,12 +1,12 @@
 # searxng.rb
 
-[![Gem Version](https://badge.fury.io/rb/searxng.svg?v=0.2.0)](https://badge.fury.io/rb/searxng) [![Test Status](https://github.com/amkisko/searxng.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/searxng.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/searxng.rb/graph/badge.svg)](https://codecov.io/gh/amkisko/searxng.rb)
+[![Gem Version](https://badge.fury.io/rb/searxng.svg?v=0.2.1)](https://badge.fury.io/rb/searxng) [![Test Status](https://github.com/amkisko/searxng.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/searxng.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/searxng.rb/graph/badge.svg)](https://app.codecov.io/github/amkisko/searxng.rb)
 
 Ruby gem providing a SearXNG HTTP client, CLI (search), and MCP (Model Context Protocol) server for web search. Integrates with MCP-compatible clients like Codex, Cursor, Claude, and other MCP-enabled tools.
 
 ## Requirements
 
-- **Ruby 3.1 or higher** (Ruby 3.0 and earlier are not supported). For managing Ruby versions, [rbenv](https://github.com/rbenv/rbenv) or [mise](https://mise.jdx.dev/) are recommended; system Ruby may be sufficient if it meets the version requirement.
+- **Ruby 3.4 or higher**. For managing Ruby versions, [rbenv](https://github.com/rbenv/rbenv) or [mise](https://mise.jdx.dev/) are recommended; system Ruby may be sufficient if it meets the version requirement.
 
 ## Quick Start
 
@@ -51,9 +51,11 @@ end
 - **SEARXNG_CA_FILE** / **SEARXNG_CA_PATH** (optional): Custom CA certificate file or directory for HTTPS. You can also pass `ca_file:`, `ca_path:`, or `verify_mode:` to `Searxng::Client.new`.
 - **SEARXNG_USER_AGENT** (optional): Custom User-Agent string. The client sends a default identifying the gem; if your instance returns 403 Forbidden (e.g. bot detection), set a custom User-Agent or pass `user_agent:` to `Searxng::Client.new`.
 - **HTTP_PROXY / HTTPS_PROXY / ALL_PROXY / NO_PROXY** (optional): Proxy configuration for HTTP(S) requests.
-- **FTP_USER / FTP_PASSWORD** (optional): FTP credentials used when URL doesn’t include auth.
-- **SFTP_USER / SFTP_PASSWORD** (optional): SFTP credentials used when URL doesn’t include auth.
-- **SMB_USER / SMB_PASSWORD / SMB_DOMAIN** (optional): SMB credentials/domain used when URL doesn’t include auth.
+- **SEARXNG_WEB_URL_SCHEMES** (optional): Comma-separated protocols enabled for `web_url_read`. The secure default is `http,https,ipfs`; opt in to any required subset of `ftp,sftp,smb,gemini`.
+- **SEARXNG_WEB_URL_CREDENTIAL_HOSTS** (optional): Comma-separated host allowlist permitted to receive credentials from the FTP, SFTP, or SMB environment variables. Credentials embedded directly in a URL remain scoped to that URL.
+- **FTP_USER / FTP_PASSWORD** (optional): FTP credentials used only for hosts in `SEARXNG_WEB_URL_CREDENTIAL_HOSTS`.
+- **SFTP_USER / SFTP_PASSWORD** (optional): SFTP credentials used only for hosts in `SEARXNG_WEB_URL_CREDENTIAL_HOSTS`.
+- **SMB_USER / SMB_PASSWORD / SMB_DOMAIN** (optional): SMB credentials/domain used only for hosts in `SEARXNG_WEB_URL_CREDENTIAL_HOSTS`.
 - **IPFS_GATEWAY** (optional): Gateway used for `ipfs://` URLs (default: `https://ipfs.io`).
 - **GEMINI_INSECURE=1** (optional): disables TLS certificate verification for Gemini fetches in `web_url_read`.
 
@@ -68,7 +70,7 @@ The MCP server provides the following tools:
 2. **web_url_read** - Fetch a URL and return Markdown content
    - Parameters: `url` (required), `startChar`, `maxLength`, `section`, `paragraphRange`, `readHeadings`, `timeoutMs` (all optional).
    - Uses `teplo_core` for HTML/XML to Markdown conversion (with workspace fallback to `textplorer/core-ruby` in development).
-   - Supports `http`, `https`, `ftp`, `sftp`, `smb`, `gemini`, and `ipfs` URLs (`ipfs://` is resolved via `IPFS_GATEWAY`).
+   - Supports `http`, `https`, and `ipfs` by default. `ftp`, `sftp`, `smb`, and `gemini` require explicit opt-in through `SEARXNG_WEB_URL_SCHEMES`.
 
 The MCP server also exposes resources:
 
@@ -166,12 +168,12 @@ Useful for testing the `searxng_web_search` tool before integrating with Cursor
 ## Protocol Support Notes
 
 - `http` / `https`: fully supported.
-- `ftp`: supported by `web_url_read` (requires `net-ftp` runtime gem).
-- `sftp`: supported by `web_url_read` (requires `net-sftp` runtime gem).
-- `smb`: supported by `web_url_read` via `smbclient` available in `PATH`.
-- `gemini`: supported by `web_url_read` (Gemini fetch + Gemtext to Markdown conversion).
+- `ftp`: opt-in through `SEARXNG_WEB_URL_SCHEMES` (requires the `net-ftp` runtime gem).
+- `sftp`: opt-in through `SEARXNG_WEB_URL_SCHEMES` (requires the `net-sftp` runtime gem).
+- `smb`: opt-in through `SEARXNG_WEB_URL_SCHEMES` and uses `smbclient` available in `PATH`.
+- `gemini`: opt-in through `SEARXNG_WEB_URL_SCHEMES` (Gemini fetch + Gemtext to Markdown conversion).
 - `ipfs`: supported by `web_url_read` through gateway resolution (`ipfs://` -> `IPFS_GATEWAY`).
-- `tor` / `i2p`: supported through `.onion` / `.i2p` hosts over HTTP(S), typically with proxy configuration.
+- `.onion` / `.i2p`: not supported by `web_url_read` (destination policy resolves hosts locally before any proxy).
 
 ## Examples
 
@@ -217,6 +219,19 @@ For more information, see [CONTRIBUTING.md](CONTRIBUTING.md).
 
 If you discover a security vulnerability, please report it responsibly. See [SECURITY.md](SECURITY.md) for details.
 
+## Links
+
+- [GitHub](https://github.com/amkisko/searxng.rb)
+- [GitLab](https://gitlab.com/amkisko/searxng.rb)
+- [RubyGems](https://rubygems.org/gems/searxng)
+- [Versions Atom](https://rubygems.org/gems/searxng/versions.atom) (feed id `10648244160064`)
+- [libraries.io](https://libraries.io/rubygems/searxng)
+- [Deps.dev](https://deps.dev/rubygems/searxng)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_searxng.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/searxng.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/searxng.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/searxng.rb)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/bin/searxng

@@ -5,13 +5,16 @@ cmd = ARGV.shift
 case cmd
 when "serve"
   unless ENV["DEBUG"]
-    require "stringio"
-    $stderr = StringIO.new
-    $stderr.set_encoding("UTF-8")
+    $stderr.reopen(File::NULL, "w")
   end
   $LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
   require "searxng/server"
-  Searxng::Server.start
+  begin
+    Searxng::Server.start
+  rescue Searxng::ConfigurationError => e
+    warn e.message
+    exit 1
+  end
 when "search"
   $LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
   require "searxng"

data/lib/searxng/client.rb

@@ -24,9 +24,13 @@ module Searxng
       user_agent: nil,
       configure_http: nil
     )
-      @base_url = (base_url || ENV["SEARXNG_URL"] || DEFAULT_BASE_URL).to_s.chomp("/")
-      @user = user || ENV["SEARXNG_USER"] || ENV["AUTH_USERNAME"]
-      @password = password || ENV["SEARXNG_PASSWORD"] || ENV["AUTH_PASSWORD"]
+      @base_url = if base_url.nil?
+        present_string(ENV["SEARXNG_URL"]) || DEFAULT_BASE_URL
+      else
+        base_url.to_s.strip
+      end.chomp("/")
+      @user = present_string(user) || present_string(ENV["SEARXNG_USER"]) || present_string(ENV["AUTH_USERNAME"])
+      @password = present_string(password) || present_string(ENV["SEARXNG_PASSWORD"]) || present_string(ENV["AUTH_PASSWORD"])
       @open_timeout = open_timeout
       @read_timeout = read_timeout
       @ca_file = ca_file || ENV["SEARXNG_CA_FILE"]
@@ -49,13 +53,30 @@ module Searxng
     def build_search_uri(query, pageno:, time_range:, language:, safesearch:)
       uri = URI.join("#{@base_url}/", "search")
       params = {"q" => query, "format" => "json", "pageno" => pageno.to_s}
-      params["time_range"] = time_range if time_range && VALID_TIME_RANGES.include?(time_range.to_s)
+      if time_range
+        range = time_range.to_s
+        unless VALID_TIME_RANGES.include?(range)
+          raise ConfigurationError, "Invalid time_range: #{time_range.inspect} (allowed: #{VALID_TIME_RANGES.join(", ")})"
+        end
+        params["time_range"] = range
+      end
       params["language"] = language if language && language != "all"
-      params["safesearch"] = safesearch.to_s if safesearch && VALID_SAFESEARCH.include?(safesearch.to_i)
+      unless safesearch.nil?
+        value = Integer(safesearch, exception: false)
+        unless value && VALID_SAFESEARCH.include?(value)
+          raise ConfigurationError, "Invalid safesearch: #{safesearch.inspect} (allowed: #{VALID_SAFESEARCH.join(", ")})"
+        end
+        params["safesearch"] = value.to_s
+      end
       uri.query = URI.encode_www_form(params)
       uri
     end
 
+    def present_string(value)
+      text = value&.to_s&.strip
+      text unless text.nil? || text.empty?
+    end
+
     def perform_request(uri)
       http = build_http(uri)
       @configure_http&.call(http, uri)
@@ -136,8 +157,8 @@ module Searxng
       return nil if raw.nil? || raw.strip.empty?
 
       URI(raw.include?("://") ? raw : "http://#{raw}")
-    rescue
-      nil
+    rescue URI::InvalidURIError, ArgumentError
+      raise ConfigurationError, "Proxy URL is invalid: #{raw.inspect}"
     end
 
     def no_proxy_match?(host)

data/lib/searxng/errors.rb

@@ -70,5 +70,13 @@ module Searxng
         "SearXNG returned #{status_code} #{status_message}".strip
       end
     end
+
+    def fetch_http_error(status_code, status_message, location: nil)
+      code = status_code.to_i
+      base = "Website Error (#{code}): #{status_message}".strip
+      return "#{base} Location: #{location}" if location && !location.to_s.strip.empty?
+
+      base
+    end
   end
 end

data/lib/searxng/network_policy.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "socket"
+require "uri"
+
+module Searxng
+  class NetworkPolicy
+    FORBIDDEN_RANGES = %w[
+      0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8
+      169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24
+      192.88.99.0/24 192.168.0.0/16 198.18.0.0/15 198.51.100.0/24
+      203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
+      ::/128 ::1/128 ::/96 64:ff9b::/96 64:ff9b:1::/48 100::/64
+      2001::/23 2001:db8::/32 2002::/16 3fff::/20
+      fc00::/7 fe80::/10 fec0::/10 ff00::/8
+    ].map { |range| IPAddr.new(range) }.freeze
+
+    def self.validate!(url, allowed_schemes:, allow_userinfo: false)
+      uri = URI.parse(url.to_s)
+      reject! unless allowed_schemes.include?(uri.scheme&.downcase)
+      reject! if hostname_of(uri).to_s.empty? || (uri.userinfo && !allow_userinfo)
+
+      [uri, allowed_ip_address(uri)]
+    rescue URI::InvalidURIError
+      reject!
+    end
+
+    def self.allowed_ip_address(uri)
+      host = hostname_of(uri)
+      addresses = Addrinfo.getaddrinfo(host, uri.port, nil, :STREAM)
+        .map(&:ip_address)
+        .uniq
+      reject! if addresses.empty? || addresses.any? { |address| forbidden?(address) }
+
+      addresses.first
+    rescue SocketError, SystemCallError
+      reject!
+    end
+    private_class_method :allowed_ip_address
+
+    def self.hostname_of(uri)
+      uri.respond_to?(:hostname) ? uri.hostname : uri.host.to_s.delete_prefix("[").delete_suffix("]")
+    end
+    private_class_method :hostname_of
+
+    def self.forbidden?(address)
+      parsed = normalize_address(address)
+      return true if FORBIDDEN_RANGES.any? { |range| range.include?(parsed) }
+      return forbidden?(parsed.native.to_s) if ipv4_compatible?(parsed)
+
+      false
+    rescue IPAddr::InvalidAddressError
+      true
+    end
+    private_class_method :forbidden?
+
+    def self.normalize_address(address)
+      parsed = IPAddr.new(address.split("%", 2).first)
+      parsed.ipv4_mapped? ? parsed.native : parsed
+    end
+    private_class_method :normalize_address
+
+    def self.ipv4_compatible?(parsed)
+      parsed.ipv6? && parsed.respond_to?(:ipv4_compat?) && parsed.ipv4_compat?
+    end
+    private_class_method :ipv4_compatible?
+
+    def self.reject!
+      raise ConfigurationError, "URL destination is not allowed"
+    end
+    private_class_method :reject!
+  end
+end

data/lib/searxng/server.rb

@@ -8,6 +8,7 @@ require "socket"
 require "time"
 require "timeout"
 require "uri"
+require "searxng/network_policy"
 
 FastMcp = MCP unless defined?(FastMcp)
 
@@ -176,52 +177,72 @@ module Searxng
       annotations(readOnlyHint: true, openWorldHint: true) if respond_to?(:annotations)
 
       CACHE_TTL_SECONDS = 300
+      CACHE_MAX_ENTRIES = 32
+      CACHE_MAX_BYTES = 8 * 1024 * 1024
+      MAX_FETCH_BYTES = 2 * 1024 * 1024
+      DEFAULT_MAX_LENGTH = 20_000
+      MIN_TIMEOUT_MS = 1_000
+      MAX_TIMEOUT_MS = 30_000
+      DEFAULT_URL_SCHEMES = %w[http https ipfs].freeze
+      SUPPORTED_URL_SCHEMES = %w[http https ftp sftp smb gemini ipfs].freeze
       @@url_cache = {} # rubocop:disable Style/ClassVars
+      @@url_cache_bytes = 0 # rubocop:disable Style/ClassVars
+      @@url_cache_mutex = Mutex.new # rubocop:disable Style/ClassVars
 
       arguments do
         required(:url).filled(:string).description("URL to fetch and read")
         optional(:startChar).filled(:integer).description("Starting character position (default: 0)")
-        optional(:maxLength).filled(:integer).description("Maximum characters to return")
+        optional(:maxLength).filled(:integer).description("Maximum characters to return (default: 20000)")
         optional(:section).filled(:string).description("Extract by heading text")
         optional(:paragraphRange).filled(:string).description("Paragraph range, e.g. '1-5', '3', '10-'")
         optional(:readHeadings).filled(:bool).description("Return only headings when true")
-        optional(:timeoutMs).filled(:integer).description("Request timeout in ms (default: 10000)")
+        optional(:timeoutMs).filled(:integer).description("Request timeout in ms (default: 10000, clamped 1000..30000)")
       end
 
       def call(url:, **kwargs)
         start_char = kwargs.fetch(:startChar, 0)
-        max_length = kwargs[:maxLength]
+        max_length = kwargs.fetch(:maxLength, DEFAULT_MAX_LENGTH)
         section = kwargs[:section]
         paragraph_range = kwargs[:paragraphRange]
         read_headings = kwargs.fetch(:readHeadings, false)
-        timeout_ms = kwargs.fetch(:timeoutMs, 10_000)
+        timeout_ms = clamp_timeout_ms(kwargs.fetch(:timeoutMs, 10_000))
 
         normalized = normalize_url(url)
         uri = URI.parse(normalized)
+        ensure_scheme_enabled!(uri.scheme)
+        unless uri.scheme == "ipfs"
+          _validated_uri, ip_address = NetworkPolicy.validate!(
+            normalized,
+            allowed_schemes: [uri.scheme],
+            allow_userinfo: !%w[http https].include?(uri.scheme)
+          )
+        end
         markdown = case uri.scheme
         when "http", "https"
-          html = fetch_html(normalized, timeout_ms: timeout_ms.to_i)
-          convert_to_markdown(html, normalized)
+          html = fetch_html(normalized, timeout_ms: timeout_ms)
+          convert_to_markdown(html, redact_uri_string(normalized))
         when "ftp"
-          content = fetch_ftp(uri, timeout_ms: timeout_ms.to_i)
-          convert_fetched_content(content, normalized)
+          content = fetch_ftp(uri, ip_address: ip_address, timeout_ms: timeout_ms)
+          convert_fetched_content(content, redact_uri_string(normalized))
         when "sftp"
-          content = fetch_sftp(uri, timeout_ms: timeout_ms.to_i)
-          convert_fetched_content(content, normalized)
+          content = fetch_sftp(uri, ip_address: ip_address, timeout_ms: timeout_ms)
+          convert_fetched_content(content, redact_uri_string(normalized))
         when "smb"
-          content = fetch_smb(uri, timeout_ms: timeout_ms.to_i)
-          convert_fetched_content(content, normalized)
+          content = fetch_smb(uri, ip_address: ip_address, timeout_ms: timeout_ms)
+          convert_fetched_content(content, redact_uri_string(normalized))
         when "gemini"
-          gemtext = fetch_gemini(uri, timeout_ms: timeout_ms.to_i)
+          gemtext = fetch_gemini(uri, ip_address: ip_address, timeout_ms: timeout_ms)
           gemtext_to_markdown(gemtext, uri)
         when "ipfs"
           gateway_url = resolve_ipfs_url(uri)
-          html = fetch_html(gateway_url, timeout_ms: timeout_ms.to_i)
+          html = fetch_html(gateway_url, timeout_ms: timeout_ms)
           convert_to_markdown(html, gateway_url)
         else
           raise ConfigurationError, %(Unsupported URL scheme "#{uri.scheme}". Supported schemes: http, https, ftp, sftp, smb, gemini, ipfs.)
         end
         apply_options(markdown, start_char: start_char, max_length: max_length, section: section, paragraph_range: paragraph_range, read_headings: read_headings)
+      rescue Searxng::Error => e
+        "Error: #{e.message}"
       end
 
       private
@@ -245,35 +266,70 @@ module Searxng
         raise ConfigurationError, %(URL Format Error: Invalid URL "#{url}")
       end
 
+      def ensure_scheme_enabled!(scheme)
+        return if enabled_url_schemes.include?(scheme)
+
+        raise ConfigurationError, %(URL scheme "#{scheme}" is not enabled)
+      end
+
+      def enabled_url_schemes
+        configured = ENV["SEARXNG_WEB_URL_SCHEMES"]
+        return DEFAULT_URL_SCHEMES unless configured
+
+        configured.split(",").map { |scheme| scheme.strip.downcase } & SUPPORTED_URL_SCHEMES
+      end
+
+      def clamp_timeout_ms(value)
+        value.to_i.clamp(MIN_TIMEOUT_MS, MAX_TIMEOUT_MS)
+      end
+
+      def redact_uri_string(url)
+        uri = url.is_a?(URI) ? url.dup : URI.parse(url.to_s)
+        uri.user = nil
+        uri.password = nil
+        uri.to_s
+      rescue URI::InvalidURIError
+        "(invalid URL)"
+      end
+
       def fetch_html(url, timeout_ms:)
         now = Time.now.to_i
-        cached = @@url_cache[url]
-        if cached && (now - cached[:at] <= CACHE_TTL_SECONDS)
-          return cached[:html]
-        end
+        cached = cache_get(url, now: now)
+        return cached if cached
 
-        uri = URI.parse(url)
+        uri, ip_address = NetworkPolicy.validate!(url, allowed_schemes: %w[http https])
         client = get_client
-        http = client.send(:build_http, uri)
-        request = Net::HTTP::Get.new(uri)
-        request["User-Agent"] = "searxng-ruby/#{Searxng::VERSION} web_url_read"
-        response = nil
-        Timeout.timeout(timeout_ms / 1000.0) { response = http.request(request) }
-        unless response.is_a?(Net::HTTPSuccess)
-          raise APIError.new(
-            ErrorMessages.api_error(response.code.to_i, response.message),
-            status_code: response.code.to_i,
-            response_data: response.body,
-            uri: url
-          )
+        http = build_fetch_http(client, uri, ip_address, timeout_ms: timeout_ms)
+        request = Net::HTTP::Get.new(uri.request_uri)
+        request["Host"] = uri.hostname || uri.host
+        request["User-Agent"] = ENV["SEARXNG_USER_AGENT"].to_s.strip.empty? ? "searxng-ruby/#{Searxng::VERSION} web_url_read" : ENV["SEARXNG_USER_AGENT"]
+        request["Accept-Encoding"] = "identity"
+        safe_url = redact_uri_string(url)
+        body = nil
+        status_code = nil
+        status_message = nil
+        location = nil
+        Timeout.timeout(timeout_ms / 1000.0) do
+          http.request(request) do |response|
+            status_code = response.code.to_i
+            status_message = response.message
+            location = response["location"]
+            unless response.is_a?(Net::HTTPSuccess)
+              read_limited_body(response)
+              raise APIError.new(
+                ErrorMessages.fetch_http_error(status_code, status_message, location: location),
+                status_code: status_code,
+                uri: safe_url
+              )
+            end
+            body = read_limited_body(response)
+          end
         end
-
-        body = response.body.to_s
-        if body.strip.empty?
-          raise APIError.new("Content Error: Website returned empty content.", status_code: response.code.to_i, uri: url)
+        if body.to_s.strip.empty?
+          raise APIError.new("Content Error: Website returned empty content.", status_code: status_code, uri: safe_url)
         end
 
-        @@url_cache[url] = {at: now, html: body}
+        cache_put(url, body, at: now)
         body
       rescue Timeout::Error
         raise NetworkError, "Timeout Error: #{URI.parse(url).host} took longer than #{timeout_ms}ms to respond"
@@ -281,6 +337,76 @@ module Searxng
         raise NetworkError, ErrorMessages.network_error(e, uri: URI.parse(url), target: "website")
       end
 
+      def build_fetch_http(client, uri, ip_address, timeout_ms:)
+        proxy_uri = client.send(:proxy_uri_for, uri)
+        seconds = [timeout_ms / 1000.0, 1.0].max
+        if proxy_uri && uri.scheme == "http"
+          http = Net::HTTP::Proxy(proxy_uri.host, proxy_uri.port, proxy_uri.user, proxy_uri.password)
+            .new(ip_address, uri.port)
+          http.open_timeout = seconds
+          http.read_timeout = seconds
+          http.max_retries = 0 if http.respond_to?(:max_retries=)
+          return http
+        end
+
+        http = client.send(:build_http, uri)
+        http.ipaddr = ip_address
+        http.open_timeout = seconds
+        http.read_timeout = seconds
+        http.max_retries = 0 if http.respond_to?(:max_retries=)
+        http
+      end
+
+      def read_limited_body(response)
+        body = +""
+        response.read_body do |chunk|
+          body << chunk
+          if body.bytesize > MAX_FETCH_BYTES
+            raise APIError.new("Content Error: response exceeds #{MAX_FETCH_BYTES} bytes", uri: nil)
+          end
+        end
+        body
+      end
+
+      def cache_get(url, now:)
+        @@url_cache_mutex.synchronize do
+          purge_expired_cache!(now)
+          entry = @@url_cache[url]
+          (entry && (now - entry[:at] <= CACHE_TTL_SECONDS)) ? entry[:html] : nil
+        end
+      end
+
+      def cache_put(url, html, at:)
+        @@url_cache_mutex.synchronize do
+          purge_expired_cache!(at)
+          while (@@url_cache.size >= CACHE_MAX_ENTRIES || (@@url_cache_bytes + html.bytesize) > CACHE_MAX_BYTES) && !@@url_cache.empty?
+            evict_oldest_cache_entry!
+          end
+          return if html.bytesize > CACHE_MAX_BYTES
+
+          previous = @@url_cache[url]
+          @@url_cache_bytes -= previous[:html].bytesize if previous
+          @@url_cache[url] = {at: at, html: html}
+          @@url_cache_bytes += html.bytesize
+        end
+      end
+
+      def purge_expired_cache!(now)
+        @@url_cache.delete_if do |_key, entry|
+          expired = now - entry[:at] > CACHE_TTL_SECONDS
+          @@url_cache_bytes -= entry[:html].bytesize if expired
+          expired
+        end
+      end
+
+      def evict_oldest_cache_entry!
+        oldest_key, oldest = @@url_cache.min_by { |_key, entry| entry[:at] }
+        return unless oldest_key
+
+        @@url_cache_bytes -= oldest[:html].bytesize
+        @@url_cache.delete(oldest_key)
+      end
+
       def convert_to_markdown(html, base_url)
         load_teplo_core!
         ast = TeploCore.parse_html(html)
@@ -290,6 +416,8 @@ module Searxng
         else
           markdown
         end
+      rescue Searxng::Error
+        raise
       rescue => e
         raise APIError.new("Conversion Error: Cannot convert HTML to Markdown (#{base_url}) - #{e.message}", uri: base_url)
       end
@@ -302,29 +430,40 @@ module Searxng
         looks_like_markup ? convert_to_markdown(text, base_url) : text
       end
 
-      def fetch_ftp(uri, timeout_ms:)
+      def fetch_ftp(uri, timeout_ms:, ip_address: nil)
         begin
           require "net/ftp"
         rescue LoadError
           raise ConfigurationError, "FTP support requires the 'net-ftp' gem."
         end
 
+        ip_address ||= validated_ip_address(uri, allow_userinfo: true)
         body = +""
+        ftp = nil
+        safe_uri = redact_uri_string(uri)
         Timeout.timeout(timeout_ms / 1000.0) do
           ftp = Net::FTP.new
+          ftp.passive = true
+          ftp.use_pasv_ip = false if ftp.respond_to?(:use_pasv_ip=)
           begin
-            ftp.connect(uri.host, uri.port || 21)
+            ftp.connect(ip_address, uri.port || 21)
             ftp.read_timeout = [timeout_ms / 1000.0, 1.0].max
             ftp.open_timeout = [timeout_ms / 1000.0, 1.0].max
-            user = uri.user || ENV["FTP_USER"] || "anonymous"
-            pass = uri.password || ENV["FTP_PASSWORD"] || "anonymous@"
+            user = uri.user || credential_for(uri.host, "FTP_USER") || "anonymous"
+            pass = uri.password || credential_for(uri.host, "FTP_PASSWORD") || "anonymous@"
             ftp.login(user, pass)
-            path = uri.path.to_s
-            raise APIError.new("FTP path is required", uri: uri.to_s) if path.empty? || path == "/"
-
-            ftp.retrbinary("RETR #{path}", 16_384) { |chunk| body << chunk }
+            path = URI.decode_www_form_component(uri.path.to_s)
+            raise APIError.new("FTP path is required", uri: safe_uri) if path.empty? || path == "/"
+            raise ConfigurationError, "FTP path contains unsupported characters" if path.match?(/[\r\n\x00]/)
+
+            ftp.retrbinary("RETR #{path}", 16_384) do |chunk|
+              body << chunk
+              if body.bytesize > MAX_FETCH_BYTES
+                raise APIError.new("Content Error: response exceeds #{MAX_FETCH_BYTES} bytes", uri: safe_uri)
+              end
+            end
           ensure
-            ftp.close unless ftp.closed?
+            ftp&.close unless ftp.nil? || ftp.closed?
           end
         end
         body
@@ -332,65 +471,78 @@ module Searxng
         raise NetworkError, "Timeout Error: #{uri.host} took longer than #{timeout_ms}ms to respond"
       rescue SocketError, Errno::ECONNREFUSED, Errno::ETIMEDOUT, Errno::ECONNRESET, Errno::EPIPE, EOFError => e
         raise NetworkError, ErrorMessages.network_error(e, uri: uri, target: "FTP server")
+      rescue Searxng::Error
+        raise
       rescue => e
         if e.class.name.start_with?("Net::FTP")
-          raise APIError.new("FTP Error: #{e.message}", uri: uri.to_s)
+          raise APIError.new("FTP Error: #{e.message}", uri: redact_uri_string(uri))
         end
         raise e
       end
 
-      def fetch_sftp(uri, timeout_ms:)
+      def fetch_sftp(uri, timeout_ms:, ip_address: nil)
         begin
           require "net/sftp"
         rescue LoadError
           raise ConfigurationError, "SFTP support requires the 'net-sftp' gem."
         end
 
-        user = uri.user || ENV["SFTP_USER"]
-        password = uri.password || ENV["SFTP_PASSWORD"]
+        ip_address ||= validated_ip_address(uri, allow_userinfo: true)
+        user = uri.user || credential_for(uri.host, "SFTP_USER")
+        password = uri.password || credential_for(uri.host, "SFTP_PASSWORD")
         raise ConfigurationError, "SFTP requires username (sftp://user@host/path or SFTP_USER)." unless user
 
-        path = uri.path.to_s
-        raise APIError.new("SFTP path is required", uri: uri.to_s) if path.empty? || path == "/"
+        path = URI.decode_www_form_component(uri.path.to_s)
+        safe_uri = redact_uri_string(uri)
+        raise APIError.new("SFTP path is required", uri: safe_uri) if path.empty? || path == "/"
+        raise ConfigurationError, "SFTP path contains unsupported characters" if path.match?(/[\r\n\x00]/)
 
         result = nil
         Timeout.timeout(timeout_ms / 1000.0) do
-          Net::SFTP.start(uri.host, user, password: password, port: uri.port || 22, non_interactive: true, verify_host_key: :never) do |sftp|
-            result = sftp.download!(path)
+          options = {password: password, port: uri.port || 22, non_interactive: true, verify_host_key: :always}
+          options[:host_key_alias] = uri.host if uri.host
+          Net::SFTP.start(ip_address, user, **options) do |sftp|
+            result = sftp.download!(path).to_s
           end
         end
+        if result.to_s.bytesize > MAX_FETCH_BYTES
+          raise APIError.new("Content Error: response exceeds #{MAX_FETCH_BYTES} bytes", uri: safe_uri)
+        end
         result.to_s
       rescue Timeout::Error
         raise NetworkError, "Timeout Error: #{uri.host} took longer than #{timeout_ms}ms to respond"
       rescue SocketError, Errno::ECONNREFUSED, Errno::ETIMEDOUT, Errno::ECONNRESET, Errno::EPIPE, EOFError => e
         raise NetworkError, ErrorMessages.network_error(e, uri: uri, target: "SFTP server")
+      rescue Searxng::Error
+        raise
       rescue => e
         raise e if e.is_a?(ConfigurationError)
         if e.class.name.include?("StatusException")
           description = e.respond_to?(:description) ? e.description : e.message
-          raise APIError.new("SFTP Error: #{description}", uri: uri.to_s)
+          raise APIError.new("SFTP Error: #{description}", uri: safe_uri)
         end
         if e.class.name.include?("AuthenticationFailed")
-          raise APIError.new("SFTP authentication failed", uri: uri.to_s)
+          raise APIError.new("SFTP authentication failed", uri: safe_uri)
         end
-        raise APIError.new("SFTP Error: #{e.message}", uri: uri.to_s)
+        raise APIError.new("SFTP Error: #{e.message}", uri: safe_uri)
       end
 
-      def fetch_smb(uri, timeout_ms:)
+      def fetch_smb(uri, timeout_ms:, ip_address: nil)
+        ip_address ||= validated_ip_address(uri, allow_userinfo: true)
         share, remote_path = parse_smb_path(uri)
-        user = uri.user || ENV["SMB_USER"]
-        pass = uri.password || ENV["SMB_PASSWORD"]
-        domain = ENV["SMB_DOMAIN"]
+        user = uri.user || credential_for(uri.host, "SMB_USER")
+        pass = uri.password || credential_for(uri.host, "SMB_PASSWORD")
+        domain = credential_for(uri.host, "SMB_DOMAIN")
 
-        auth = if user
-          full_user = (domain && !domain.empty?) ? "#{domain}\\#{user}" : user
-          "#{full_user}%#{pass}"
+        full_user = if user
+          (domain && !domain.empty?) ? "#{domain}\\#{user}" : user
         end
 
-        escaped_remote = remote_path.gsub('"', '\"')
-        cmd = ["smbclient", "//#{uri.host}/#{share}", "-c", %(get "#{escaped_remote}" -)]
-        if auth
-          cmd << "-U" << auth
+        cmd = ["smbclient", "//#{ip_address}/#{share}", "-c", %(get "#{remote_path}" -), "-t", [(timeout_ms / 1000.0).ceil, 1].max.to_s]
+        env = {}
+        if full_user
+          cmd << "-U" << full_user
+          env["PASSWD"] = pass.to_s
         else
           cmd << "-N"
         end
@@ -398,52 +550,86 @@ module Searxng
         stdout = +""
         stderr = +""
         status = nil
+        wait_thr = nil
         Timeout.timeout(timeout_ms / 1000.0) do
-          stdout, stderr, status = Open3.capture3(*cmd)
+          Open3.popen3(env, *cmd) do |stdin, out, err, thr|
+            stdin.close
+            wait_thr = thr
+            stdout = out.read.to_s
+            stderr = err.read.to_s
+            status = thr.value
+          end
+        end
+        if stdout.bytesize > MAX_FETCH_BYTES
+          raise APIError.new("Content Error: response exceeds #{MAX_FETCH_BYTES} bytes", uri: redact_uri_string(uri))
         end
 
-        raise APIError.new("SMB Error: #{stderr.strip.empty? ? "request failed" : stderr.strip}", uri: uri.to_s) unless status.success?
+        raise APIError.new("SMB Error: #{stderr.strip.empty? ? "request failed" : stderr.strip[0, 500]}", uri: redact_uri_string(uri)) unless status&.success?
 
         stdout
       rescue Errno::ENOENT
         raise ConfigurationError, "SMB support requires 'smbclient' to be installed and available in PATH."
       rescue Timeout::Error
+        if wait_thr&.alive?
+          begin
+            Process.kill("TERM", wait_thr.pid)
+          rescue Errno::ESRCH
+          end
+        end
         raise NetworkError, "Timeout Error: #{uri.host} took longer than #{timeout_ms}ms to respond"
       rescue SocketError, Errno::ECONNREFUSED, Errno::ETIMEDOUT, Errno::ECONNRESET, Errno::EPIPE, EOFError => e
         raise NetworkError, ErrorMessages.network_error(e, uri: uri, target: "SMB server")
       end
 
       def parse_smb_path(uri)
-        segments = uri.path.to_s.split("/").reject(&:empty?)
+        raw_path = uri.path.to_s
+        segments = raw_path.split("/").reject(&:empty?).map { |segment| URI.decode_www_form_component(segment) }
         share = segments.shift
         remote = segments.join("/")
-        raise APIError.new("SMB path must include share and file (smb://host/share/path/file)", uri: uri.to_s) if share.to_s.empty? || remote.empty?
+        raise APIError.new("SMB path must include share and file (smb://host/share/path/file)", uri: redact_uri_string(uri)) if share.to_s.empty? || remote.empty?
+        if share.match?(/[\x00-\x1f\x7f;"\\]/) || remote.match?(/[\x00-\x1f\x7f;"\\]/)
+          raise ConfigurationError, "SMB path contains unsupported characters"
+        end
 
         [share, remote]
       end
 
-      def fetch_gemini(uri, timeout_ms:)
+      def fetch_gemini(uri, timeout_ms:, ip_address: nil)
+        ip_address ||= validated_ip_address(uri)
         response_header = nil
         body = +""
+        tcp = nil
+        ssl = nil
+        safe_uri = redact_uri_string(uri)
         Timeout.timeout(timeout_ms / 1000.0) do
-          tcp = TCPSocket.new(uri.host, uri.port || 1965)
+          tcp = TCPSocket.new(ip_address, uri.port || 1965)
           begin
             ctx = OpenSSL::SSL::SSLContext.new
-            ctx.verify_mode = (ENV["GEMINI_INSECURE"] == "1") ? OpenSSL::SSL::VERIFY_NONE : OpenSSL::SSL::VERIFY_PEER
+            if ENV["GEMINI_INSECURE"] == "1"
+              ctx.verify_mode = OpenSSL::SSL::VERIFY_NONE
+            else
+              ctx.set_params(verify_mode: OpenSSL::SSL::VERIFY_PEER)
+            end
             ssl = OpenSSL::SSL::SSLSocket.new(tcp, ctx)
             ssl.hostname = uri.host if ssl.respond_to?(:hostname=)
             ssl.connect
+            ssl.post_connection_check(uri.host) unless ENV["GEMINI_INSECURE"] == "1"
             ssl.write("#{uri}\r\n")
-            response_header = ssl.gets("\r\n")
-            body = ssl.read.to_s
-            ssl.close
+            response_header = ssl.gets("\r\n", 2048)
+            while body.bytesize <= MAX_FETCH_BYTES
+              chunk = ssl.read(16_384)
+              break if chunk.nil? || chunk.empty?
+              body << chunk
+            end
+            raise APIError.new("Content Error: response exceeds #{MAX_FETCH_BYTES} bytes", uri: safe_uri) if body.bytesize > MAX_FETCH_BYTES
           ensure
-            tcp.close unless tcp.closed?
+            ssl&.close
+            tcp&.close unless tcp.nil? || tcp.closed?
           end
         end
 
         unless response_header
-          raise APIError.new("Gemini response error: empty response header", uri: uri.to_s)
+          raise APIError.new("Gemini response error: empty response header", uri: safe_uri)
         end
 
         status, meta = response_header.strip.split(/\s+/, 2)
@@ -452,15 +638,15 @@ module Searxng
         when 20..29
           body
         when 30..39
-          raise APIError.new("Gemini redirect (#{status_code}): #{meta}", status_code: status_code, uri: uri.to_s)
+          raise APIError.new("Gemini redirect (#{status_code}): #{meta}", status_code: status_code, uri: safe_uri)
         when 40..49
-          raise APIError.new("Gemini temporary failure (#{status_code}): #{meta}", status_code: status_code, uri: uri.to_s)
+          raise APIError.new("Gemini temporary failure (#{status_code}): #{meta}", status_code: status_code, uri: safe_uri)
         when 50..59
-          raise APIError.new("Gemini permanent failure (#{status_code}): #{meta}", status_code: status_code, uri: uri.to_s)
+          raise APIError.new("Gemini permanent failure (#{status_code}): #{meta}", status_code: status_code, uri: safe_uri)
         when 60..69
-          raise APIError.new("Gemini certificate required (#{status_code}): #{meta}", status_code: status_code, uri: uri.to_s)
+          raise APIError.new("Gemini certificate required (#{status_code}): #{meta}", status_code: status_code, uri: safe_uri)
         else
-          raise APIError.new("Gemini response error (#{status_code}): #{meta}", status_code: status_code, uri: uri.to_s)
+          raise APIError.new("Gemini response error (#{status_code}): #{meta}", status_code: status_code, uri: safe_uri)
         end
       rescue Timeout::Error
         raise NetworkError, "Timeout Error: #{uri.host} took longer than #{timeout_ms}ms to respond"
@@ -498,7 +684,7 @@ module Searxng
         return target if target_uri.scheme
 
         URI.join(base_uri.to_s, target).to_s
-      rescue URI::InvalidURIError
+      rescue URI::Error
         target
       end
 
@@ -511,13 +697,40 @@ module Searxng
         end
 
         cid = uri.host.to_s
+        unless cid.match?(/\A[a-zA-Z0-9_-]+\z/)
+          raise ConfigurationError, "IPFS CID is invalid"
+        end
+
         path = uri.path.to_s
+        segments = path.split("/").reject(&:empty?)
+        segments.each do |segment|
+          decoded = URI.decode_www_form_component(segment)
+          if decoded == "." || decoded == ".." || decoded.include?("\0")
+            raise ConfigurationError, "IPFS path is not allowed"
+          end
+        end
+
         query = uri.query ? "?#{uri.query}" : ""
         "#{gateway}/ipfs/#{cid}#{path}#{query}"
       rescue URI::InvalidURIError
         raise ConfigurationError, "IPFS_GATEWAY has invalid format: #{gateway.inspect}"
       end
 
+      def credential_for(host, variable)
+        allowed_hosts = ENV["SEARXNG_WEB_URL_CREDENTIAL_HOSTS"].to_s
+          .split(",")
+          .map { |candidate| candidate.strip.downcase }
+        ENV[variable] if allowed_hosts.include?(host.downcase)
+      end
+
+      def validated_ip_address(uri, allow_userinfo: false)
+        NetworkPolicy.validate!(
+          uri.to_s,
+          allowed_schemes: [uri.scheme],
+          allow_userinfo: allow_userinfo
+        )[1]
+      end
+
       def load_teplo_core!
         return if defined?(TeploCore)
 
@@ -527,7 +740,7 @@ module Searxng
         if File.exist?("#{local}.rb")
           require local
         else
-          raise ConfigurationError, "web_url_read requires teplo_core. Install the gem or provide textplorer/core-ruby in the expected workspace location."
+          raise ConfigurationError, "web_url_read requires the teplo_core gem for HTML to Markdown conversion."
         end
       end
 
@@ -537,12 +750,16 @@ module Searxng
 
         if section && !section.strip.empty?
           section_text = extract_section(result, section)
-          result = section_text.empty? ? %(Section "#{section}" not found in the content.) : section_text
+          return %(Section "#{section}" not found in the content.) if section_text.empty?
+
+          result = section_text
         end
 
         if paragraph_range && !paragraph_range.strip.empty?
           paragraph_text = extract_paragraph_range(result, paragraph_range)
-          result = paragraph_text.empty? ? %(Paragraph range "#{paragraph_range}" is invalid or out of bounds.) : paragraph_text
+          return %(Paragraph range "#{paragraph_range}" is invalid or out of bounds.) if paragraph_text.empty?
+
+          result = paragraph_text
         end
 
         start = [start_char.to_i, 0].max
@@ -624,7 +841,7 @@ module Searxng
           environment: {
             searxng_url: safe_url(searxng_url),
             has_auth: !!(user && password),
-            has_proxy: !!(ENV["HTTP_PROXY"] || ENV["HTTPS_PROXY"] || ENV["http_proxy"] || ENV["https_proxy"]),
+            has_proxy: !!(ENV["HTTP_PROXY"] || ENV["HTTPS_PROXY"] || ENV["http_proxy"] || ENV["https_proxy"] || ENV["ALL_PROXY"] || ENV["all_proxy"]),
             has_no_proxy: !!(ENV["NO_PROXY"] || ENV["no_proxy"])
           },
           capabilities: {
@@ -672,21 +889,23 @@ module Searxng
           - `HTTP_PROXY` / `HTTPS_PROXY`
           - `ALL_PROXY` (for shared proxy config)
           - `NO_PROXY`
-          - `FTP_USER` / `FTP_PASSWORD` (optional FTP credentials)
-          - `SFTP_USER` / `SFTP_PASSWORD` (optional SFTP credentials)
-          - `SMB_USER` / `SMB_PASSWORD` / `SMB_DOMAIN` (optional SMB credentials)
+          - `SEARXNG_WEB_URL_SCHEMES` (comma-separated opt-in protocols; default: `http,https,ipfs`)
+          - `SEARXNG_WEB_URL_CREDENTIAL_HOSTS` (comma-separated hosts allowed to receive environment credentials)
+          - `FTP_USER` / `FTP_PASSWORD` (optional credentials for allowlisted hosts)
+          - `SFTP_USER` / `SFTP_PASSWORD` (optional credentials for allowlisted hosts)
+          - `SMB_USER` / `SMB_PASSWORD` / `SMB_DOMAIN` (optional credentials for allowlisted hosts)
           - `IPFS_GATEWAY` (default: `https://ipfs.io`)
           - `GEMINI_INSECURE=1` (optional, disables TLS verification for Gemini)
 
           ## Protocol Notes
           - `http` / `https`: fully supported (`searxng_web_search` + `web_url_read`)
-          - `ftp`: supported in `web_url_read` (file retrieval via FTP)
-          - `sftp`: supported in `web_url_read` (requires `net-sftp` gem)
-          - `smb`: supported in `web_url_read` via `smbclient` command
-          - `gemini`: supported in `web_url_read` (Gemini fetch + Gemtext conversion)
+          - `ftp`: opt-in through `SEARXNG_WEB_URL_SCHEMES` (file retrieval via FTP)
+          - `sftp`: opt-in through `SEARXNG_WEB_URL_SCHEMES` (requires `net-sftp` gem)
+          - `smb`: opt-in through `SEARXNG_WEB_URL_SCHEMES` via `smbclient`
+          - `gemini`: opt-in through `SEARXNG_WEB_URL_SCHEMES` (Gemini fetch + Gemtext conversion)
           - `ipfs`: supported via HTTP gateway mapping (`ipfs://...` -> `IPFS_GATEWAY`)
-          - `tor` / `i2p`: supported via `.onion` / `.i2p` hosts over HTTP(S) with proxy configuration
-          - `socks5`: configure via proxy environment and run through a local bridge/proxy compatible with your client setup
+          - `.onion` / `.i2p`: not supported by `web_url_read` (local DNS and destination policy run before any proxy)
+          - `socks5`: may work for SearXNG search via proxy env; not a bypass for `web_url_read` destination policy
 
           ## Examples
           - Search: `{"query":"latest ruby news","time_range":"day"}`

data/lib/searxng/version.rb

@@ -1,3 +1,3 @@
 module Searxng
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: searxng
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -71,6 +71,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.13'
+- !ruby/object:Gem::Dependency
+  name: polyrun
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -297,6 +311,7 @@ files:
 - lib/searxng.rb
 - lib/searxng/client.rb
 - lib/searxng/errors.rb
+- lib/searxng/network_policy.rb
 - lib/searxng/server.rb
 - lib/searxng/version.rb
 - sig/searxng.rbs
@@ -316,14 +331,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.1'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: SearXNG Ruby client and MCP server
 test_files: []