# DM Public Source Private IP Validation

## Analysis

Premium DM public source hosts are accepted before task creation, precheck creation, and source connection helper calls. Security testing found the DM path has the same SSRF-style risk class as public CDC endpoints. The smallest change is to reject public source hosts that are private or otherwise non-public before credentials are encrypted, records are created, or the regional agent is called.

## Execution Steps

1. Extract a shared public endpoint host validator in `dataflow-service-ng/app/utils`.
   - Verification: `go test ./app/utils`
   - Success: public IPs and public DNS results pass; private, loopback, link-local, multicast, unspecified, and CGNAT addresses fail.

2. Update CDC public endpoint validation to use the shared helper.
   - Verification: `go test -p=1 ./app/models/biz_changefeed/impl -run 'TestCheckCreateChangefeedNetwork|TestCheckSinkEndpointUsesClusterScope'`
   - Success: existing Essential V2 public endpoint and sink endpoint scoping behavior remains covered.

3. Add Premium DM public source host validation.
   - Verification: `go test ./app/controllers/premium_dm`
   - Success: public source private IPs fail in create, precheck, source connection validation, and source table listing; PrivateLink sources are unchanged.

4. Run broader local verification.
   - Verification: `make app-unit-test-local`
   - Success: app unit tests pass, or any unrelated sandbox/environment failures are recorded with exact failing packages.

## Risks

- DNS rebinding is not solved here; this change only validates the configured public host at request time.
- Public host validation now rejects direct localhost/private/link-local addresses that may have been accepted by old tests or manual local-only requests.