feat: SSRF env var to allow all connections before it's configured

[oetr]

In some projects, network requests can happen after the fuzz test has started, but before the user had a chance to configure allowed/denied connections.

Now the user can start Jazzer with the environmental variable JAZZER_SSRF_PERMISSIVE_UNTIL_CONFIGURED set to a truthy value and all network requests will be allowed, until the user specifies otherwise in the fuzz test using BugDetectors.allowNetworkConnections(...)

[Copilot]

Pull request overview

This PR introduces a new environment variable JAZZER_SSRF_PERMISSIVE_UNTIL_CONFIGURED to address false positives in multithreaded applications where network requests may occur after fuzzing starts but before the SSRF sanitizer is configured via BugDetectors.allowNetworkConnections(). When set, this variable allows all network connections until explicit SSRF configuration is provided.

Key Changes

• Added environment variable check in ServerSideRequestForgery static initializer to conditionally disable the default "deny all connections" behavior
• Updated SSRF error message to inform users about the new environment variable option for multithreaded scenarios
• Added test case demonstrating the permissive mode with a background thread making network requests before SSRF configuration

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
sanitizers/src/main/java/com/code_intelligence/jazzer/sanitizers/ServerSideRequestForgery.java	Modified static initializer to check for JAZZER_SSRF_PERMISSIVE_UNTIL_CONFIGURED environment variable and conditionally skip setting the restrictive connection policy; updated error message to document the new option
sanitizers/src/test/java/com/example/SsrfAllowUntilConfigured.java	New test case that simulates multithreaded fuzzing scenario with background thread making network requests before SSRF configuration
sanitizers/src/test/java/com/example/BUILD.bazel	Added test configuration for SsrfAllowUntilConfigured with the permissive environment variable enabled
docs/arguments-and-configuration-options.md	Documented the new JAZZER_SSRF_PERMISSIVE_UNTIL_CONFIGURED environment variable

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.