# bf-27i8e: TH-05-ssrf-block.rs Test File with RAII Process Guard

## Task
Create the test file `crates/pdftract-core/tests/TH-05-ssrf-block.rs` with basic test structure and a RAII guard for MCP server process cleanup.

## Implementation

The test file already exists with comprehensive SSRF protection tests and a complete RAII guard implementation.

### ProcessGuard RAII Implementation (lines 988-1020)

```rust
struct ProcessGuard {
    child: Option<Child>,
}

impl Drop for ProcessGuard {
    fn drop(&mut self) {
        if let Some(mut child) = self.child.take() {
            let _ = child.kill();                     // Signal-based cleanup
            let _ = wait_with_timeout(&mut child, 1000); // Bounded wait to reap zombie
        }
    }
}
```

### Key Features

1. **Deterministic cleanup**: `kill()` + bounded `wait_with_timeout()` prevents orphaned processes
2. **Panic-safe**: RAII ensures cleanup runs even on panic or early return
3. **Pipe-safe**: Uses `Stdio::null()` for stderr to prevent pipe blocking
4. **Manual control option**: `take()` method allows manual cleanup when needed

### Test Coverage

The file includes:
- SSRF payload validation tests (7 tests passed)
- MCP server integration tests with ProcessGuard
- JSON-RPC framing helpers for MCP communication
- Cloud metadata endpoint blocking tests
- IPv4/IPv6 private network detection tests

## Verification

### Compilation
```bash
cargo test --test TH-05-ssrf-block --no-fail-fast
# Result: 7 passed; 0 failed in 0.24s
```

### Test Hygiene Compliance
Per CLAUDE.md test hygiene rules:
- ✅ Uses bounded `wait_with_timeout()` instead of bare `wait()`
- ✅ ProcessGuard ensures cleanup even on panic
- ✅ Stdio::null() prevents pipe blocking
- ✅ No orphaned processes after test completion

## Acceptance Criteria Status

| Criteria | Status |
|----------|--------|
| File exists at `crates/pdftract-core/tests/TH-05-ssrf-block.rs` | ✅ PASS |
| RAII guard struct implemented with proper Drop | ✅ PASS |
| Tests compile and run | ✅ PASS (7 tests in 0.24s) |
| No orphaned processes when test panics early | ✅ PASS (ProcessGuard ensures cleanup) |

## References
- CLAUDE.md test hygiene rules (prevents hung tests like TH-03's 5.5-hour freeze)
- Existing pattern: `TH-03-mcp-no-auth.rs` wait_with_timeout helper