fix: block hex IPv4-mapped IPv6 in SSRF guard

The WHATWG URL parser canonicalizes dotted IPv4-mapped IPv6 literals
(e.g. ::ffff:127.0.0.1) to hex form (::ffff:7f00:1). The SSRF guard
only checked the dotted form, so hex literals bypassed the private-IP
classifier and allowed access to loopback, cloud metadata, and RFC1918
addresses.

Decode hex IPv4-mapped suffixes to dotted IPv4 before the private-range
check.

Reported-by: tonghuaroot

apps/api/src/lib/ssrf.ts

@@ -33,7 +33,19 @@ function isPrivateIPv6(ip: string): boolean {
   if (normalized.startsWith("64:ff9b:")) return true;
   if (normalized.includes("::ffff:")) {
     const v4 = normalized.split("::ffff:")[1];
-    if (v4 && isPrivateIPv4(v4)) return true;
+    if (v4) {
+      if (v4.includes(".")) {
+        if (isPrivateIPv4(v4)) return true;
+      } else {
+        const m = v4.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (m) {
+          const hi = parseInt(m[1], 16);
+          const lo = parseInt(m[2], 16);
+          const dotted = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
+          if (isPrivateIPv4(dotted)) return true;
+        }
+      }
+    }
   }
   return false;
 }

tests/unit/api/ssrf.test.ts

@@ -60,6 +60,32 @@ describe("validateFetchUrl", () => {
     await expect(validateFetchUrl("http://255.255.255.255/image.jpg")).rejects.toThrow("private");
   });
 
+  it("rejects hex IPv4-mapped IPv6 loopback (::ffff:7f00:1)", async () => {
+    await expect(validateFetchUrl("http://[::ffff:7f00:1]/")).rejects.toThrow("private");
+  });
+
+  it("rejects hex IPv4-mapped IPv6 metadata (::ffff:a9fe:a9fe)", async () => {
+    await expect(validateFetchUrl("http://[::ffff:a9fe:a9fe]/")).rejects.toThrow("private");
+  });
+
+  it("rejects hex IPv4-mapped IPv6 RFC1918 10.x (::ffff:a00:5)", async () => {
+    await expect(validateFetchUrl("http://[::ffff:a00:5]/")).rejects.toThrow("private");
+  });
+
+  it("rejects hex IPv4-mapped IPv6 RFC1918 192.168.x (::ffff:c0a8:1)", async () => {
+    await expect(validateFetchUrl("http://[::ffff:c0a8:1]/")).rejects.toThrow("private");
+  });
+
+  it("rejects hex IPv4-mapped IPv6 RFC1918 172.16.x (::ffff:ac10:1)", async () => {
+    await expect(validateFetchUrl("http://[::ffff:ac10:1]/")).rejects.toThrow("private");
+  });
+
+  it("rejects dotted IPv4-mapped IPv6 that URL parser canonicalizes to hex", async () => {
+    await expect(validateFetchUrl("http://[::ffff:127.0.0.1]/")).rejects.toThrow("private");
+    await expect(validateFetchUrl("http://[::ffff:169.254.169.254]/")).rejects.toThrow("private");
+    await expect(validateFetchUrl("http://[::ffff:10.0.0.5]/")).rejects.toThrow("private");
+  });
+
   it("rejects IPv6 unspecified address", async () => {
     await expect(validateFetchUrl("http://[::]/image.jpg")).rejects.toThrow("private");
   });