feat(wsgi): Add sentry.is_localhost for inbound filters

[sentrivana]

Mirrors https://github.com/getsentry/relay/blob/master/relay-filter/src/localhost.rs

Part 1 of #7727

[github-actions]

Codecov Results 📊

✅ 130251 passed | ⏭️ 7169 skipped | Total: 137420 | Pass Rate: 94.78% | Execution Time: 436m 12s

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +949
Passed Tests	📈 +950
Failed Tests	📉 -1
Skipped Tests	—

➖ Removed Tests (1)

View removed tests

• test_cache_spans_decorator[True]
  • File: tests.integrations.django.test_cache_module

All tests are passing successfully.

✅ Patch coverage is 100.00%. Project has 2554 uncovered lines.
❌ Project coverage is 90.26%. Comparing base (2a499ec) to head (c734878).

Coverage diff

@@            Coverage Diff             @@
##        master       #PR       +/-##
==========================================
- Coverage    90.28%    90.26%    -0.02%
==========================================
  Files          195       195         —
  Lines        26197     26220       +23
  Branches      9758      9774       +16
==========================================
+ Hits         23650     23666       +16
- Misses        2547      2554        +7
- Partials      1484      1484         —

---

Generated by Codecov Action

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9426a24. Configure here.}

[sentry-warden]

IPv6 loopback Host headers are not classified as localhost

_is_localhost splits Host and X-Forwarded-Host values at the first colon, so [::1]:8080 becomes [ and fails the local-domain check. The check also does not recognize ::1 as a host domain, even without a port. Consequently, these headers are classified as non-local unless the client IP independently matches; parse bracketed IPv6 literals and recognize the loopback address.

Evidence

• SentryWsgiMiddleware passes the client IP, SERVER_NAME, HTTP_HOST, and HTTP_X_FORWARDED_HOST to _is_localhost.
• _is_localhost checks client IPs against _LOCAL_IPS, but splits each host header at the first colon before calling _host_matches_local_domain.
• For [::1]:8080, that split produces [. The matcher only accepts localhost and 127.0.0.1, so ::1 would not match even if the brackets were parsed correctly.
• With a non-loopback client IP, an IPv6 loopback host header therefore produces a false result.

_{Identified by Warden · code-review · WMM-RCU}

[sentry-warden]

IPv6 loopback Host headers are not detected as localhost

_LOCAL_DOMAINS omits ::1, and host parsing uses split(":")[0], so Host values like [::1] or [::1]:8080 never match unless client_ip is already loopback.

Evidence

• _LOCAL_IPS includes ::1, but _LOCAL_DOMAINS is only localhost and 127.0.0.1.
• _is_localhost() strips ports with header_val.split(":")[0] before _host_matches_local_domain().
• For [::1]:8080, that yields [, which does not match; bare ::1 is also not in _LOCAL_DOMAINS.
• Tests cover client_ip="::1" but not IPv6 Host / X-Forwarded-Host forms.

Also found at 3 additional locations

• tests/integrations/wsgi/test_wsgi.py:1344-1345
• sentry_sdk/utils.py:2241-2243
• tests/test_utils.py:1433-1439

_{Identified by Warden · find-bugs · HAM-7BK}