Clarify Uri.IsLoopback SSRF limitations

[Copilot]

Uri.IsLoopback alone does not guarantee that a request avoids local resources. Host resolution can still route a URI to a local address when the property returns false.

• Documentation
  • Add an SSRF warning to Uri.IsLoopback remarks.
  • Explain that additional mitigations are required for requests targeting untrusted hosts.

---

Internal previews

File	Preview link
xml/System/Uri.xml	Learn preview

Build report

[Copilot]

🟡 Changes recommended

The new warning text should be rephrased to avoid a double negative and to be more technically precise about host name resolution.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR clarifies the security limitations of using Uri.IsLoopback as a safeguard by adding an SSRF-focused warning to the API remarks, emphasizing that host resolution can still route requests to local resources.

Changes:

• Add a warning callout to the Uri.IsLoopback remarks describing SSRF risk when resolving untrusted hosts.

File summaries

File	Description
xml/System/Uri.xml	Adds an SSRF warning callout in Uri.IsLoopback remarks to clarify that IsLoopback == false doesn’t prevent resolving to local addresses.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.