External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: block hex IPv4-mapped IPv6 in SSRF guard

Browse Source 
The WHATWG URL parser canonicalizes dotted IPv4-mapped IPv6 literals
(e.g. ::ffff:127.0.0.1) to hex form (::ffff:7f00:1). The SSRF guard
only checked the dotted form, so hex literals bypassed the private-IP
classifier and allowed access to loopback, cloud metadata, and RFC1918
addresses.

Decode hex IPv4-mapped suffixes to dotted IPv4 before the private-range
check.

Reported-by: tonghuaroot
This commit is contained in:
SnapOtter
2026-06-06 20:27:48 +08:00
parent 3b84fab765
commit f64cbdda4e
2 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/api/ssrf.test.ts
+26
View File
@@ -60,6 +60,32 @@ describe("validateFetchUrl", () => {
await expect(validateFetchUrl("http://255.255.255.255/image.jpg")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 loopback (::ffff:7f00:1)", async () => {
await expect(validateFetchUrl("http://[::ffff:7f00:1]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 metadata (::ffff:a9fe:a9fe)", async () => {
await expect(validateFetchUrl("http://[::ffff:a9fe:a9fe]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 RFC1918 10.x (::ffff:a00:5)", async () => {
await expect(validateFetchUrl("http://[::ffff:a00:5]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 RFC1918 192.168.x (::ffff:c0a8:1)", async () => {
await expect(validateFetchUrl("http://[::ffff:c0a8:1]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 RFC1918 172.16.x (::ffff:ac10:1)", async () => {
await expect(validateFetchUrl("http://[::ffff:ac10:1]/")).rejects.toThrow("private");
});
it("rejects dotted IPv4-mapped IPv6 that URL parser canonicalizes to hex", async () => {
await expect(validateFetchUrl("http://[::ffff:127.0.0.1]/")).rejects.toThrow("private");
await expect(validateFetchUrl("http://[::ffff:169.254.169.254]/")).rejects.toThrow("private");
await expect(validateFetchUrl("http://[::ffff:10.0.0.5]/")).rejects.toThrow("private");
});
it("rejects IPv6 unspecified address", async () => {
await expect(validateFetchUrl("http://[::]/image.jpg")).rejects.toThrow("private");
});