A superscript-1 walks past every Go SSRF guard

TL;DR. golang.org/x/net/idna.Lookup.ToASCII runs UTS-46 NFKC mapping on hostnames, which folds 100 non-ASCII Unicode digit codepoints (math superscripts, circled digits, fullwidth digits, math-styled digits, and others) to ASCII 0-9 . A pre-IDNA net.ParseIP check rejects the non-ASCII input as not-an-IP, hands it to the library, and gets back a real IPv4 literal. That literal then walks past SSRF allowlists, NO_PROXY lists, TLS-SNI routers, and cookie-domain validators that only checked the pre-