fix: narrow Chromium Google DNS block to exact telemetry hosts

The --host-resolver-rules added to block Chromium phoning home to
Google wildcarded *.google.com and *.googleapis.com, which also
blocked legitimate diagram-triggered subresources under those
domains (e.g. fonts.googleapis.com), regardless of KROKI_*_SAFE_MODE
or *_ALLOWED_ORIGINS. List the exact hosts confirmed by packet
capture instead, leaving other googleapis.com/google.com subresources
governed by the existing applyNetworkPolicy request policy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: ggrossetie

CHANGELOG.md

@@ -21,7 +21,7 @@ versioned entry and uses it as the GitHub release notes.
 
 - Prevent unauthenticated remote code execution on `/tikz/svg` via `\special{ps:...}`: `dvisvgm` hands PostScript specials embedded in the DVI off to Ghostscript, which `dvisvgm` starts with `-dDELAYSAFER` instead of `-dSAFER`, leaving the `%pipe%` device available and allowing arbitrary command execution regardless of `KROKI_SAFE_MODE` — including `SECURE`, since that setting only restricts kpathsea (LaTeX) file access and has no effect on Ghostscript. Fixed by passing `--no-specials=ps` to `dvisvgm` so PostScript specials are never processed
 - Prevent BPMN diagram source from executing arbitrary HTML/JavaScript in the companion's headless Chromium page: the diagram source was assigned to the rendering container via `innerHTML` before being handed to bpmn-js, so a crafted request to `/bpmn/svg` could inject an element (e.g. `<img onerror=...>`) that ran script in that page; combined with the browser's `--disable-web-security` flag (same-origin policy disabled), that script could issue cross-origin requests and read the responses. Fixed by clearing the container instead of parsing the diagram source as HTML, and by dropping `--disable-web-security` — the only reason it was set, local file access, is already covered by the shared `--allow-file-access-from-files` flag ([#2089](https://github.com/yuzutech/kroki/pull/2089))
-- Stop the headless Chromium instance shared by the Mermaid, BPMN, Excalidraw and diagrams.net companions from phoning home to Google (`update.googleapis.com`, `clients2.google.com`, `android.clients.google.com`, `accounts.google.com`, `www.google.com`) as soon as it launches: several independent Chromium subsystems (GCM device checkin, network-time sync, the component updater, ...) each reach out to their own Google endpoint, so disabling them one flag at a time (`--disable-component-update`, `--disable-domain-reliability`, `--no-pings`) still left some contacting Google — confirmed by packet capture. Fixed by blocking DNS resolution for `*.google.com` and `*.googleapis.com` at the browser level via `--host-resolver-rules`, so nothing Chromium does can reach Google regardless of which internal subsystem tries
+- Stop the headless Chromium instance shared by the Mermaid, BPMN, Excalidraw and diagrams.net companions from phoning home to Google (`update.googleapis.com`, `clients2.google.com`, `android.clients.google.com`, `accounts.google.com`, `www.google.com`) as soon as it launches: several independent Chromium subsystems (GCM device checkin, network-time sync, the component updater, ...) each reach out to their own Google endpoint, so disabling them one flag at a time (`--disable-component-update`, `--disable-domain-reliability`, `--no-pings`) still left some contacting Google — confirmed by packet capture. Fixed by blocking DNS resolution for those exact hosts at the browser level via `--host-resolver-rules` — not a `*.google.com`/`*.googleapis.com` wildcard, so it doesn't also block legitimate diagram-triggered subresources under the same domains (e.g. `fonts.googleapis.com`), which remain governed by the existing `KROKI_*_SAFE_MODE`/`*_ALLOWED_ORIGINS` request policy
 
 ### Changed
 

lib/browser-instance/index.js

@@ -31,16 +31,27 @@ const BASE_ARGS = [
   // updater (update.googleapis.com) — confirmed by packet capture even with
   // --disable-component-update/--disable-domain-reliability/--no-pings set.
   // Disabling each subsystem individually is whack-a-mole across Chromium
-  // versions, so instead block DNS resolution for the two domains that cover
-  // all of them outright. Scoped narrowly (not e.g. *.gstatic.com or
-  // *.googleusercontent.com) so it doesn't affect legitimate cross-origin
-  // fetches under KROKI_*_SAFE_MODE=unsafe; extend if packet capture turns up
-  // another Google host doing this.
+  // versions, so instead block DNS resolution for the exact hosts confirmed
+  // by packet capture. Listed individually rather than as a *.google.com /
+  // *.googleapis.com wildcard so this doesn't also swallow legitimate
+  // diagram-triggered subresources under the same domains (e.g.
+  // fonts.googleapis.com) — those are already gated by applyNetworkPolicy
+  // below (KROKI_*_SAFE_MODE / *_ALLOWED_ORIGINS), which is the right layer
+  // to opt into them. Extend this list if packet capture turns up another
+  // Google host doing this.
   '--disable-component-update',
   '--disable-domain-reliability',
   '--no-pings',
   '--host-resolver-rules=' +
-    ['*.google.com', '*.googleapis.com'].map(pattern => `MAP ${pattern} 127.0.0.1`).join(','),
+    [
+      'update.googleapis.com',
+      'clients2.google.com',
+      'android.clients.google.com',
+      'accounts.google.com',
+      'www.google.com'
+    ]
+      .map(host => `MAP ${host} 127.0.0.1`)
+      .join(','),
   // Run in headless mode, i.e., without a UI or display server dependencies
   '--headless',
   // Prevents creating scrollbars for web content. Useful for taking consistent screenshots.