External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: block hex IPv4-mapped IPv6 in SSRF guard

Browse Source 
The WHATWG URL parser canonicalizes dotted IPv4-mapped IPv6 literals
(e.g. ::ffff:127.0.0.1) to hex form (::ffff:7f00:1). The SSRF guard
only checked the dotted form, so hex literals bypassed the private-IP
classifier and allowed access to loopback, cloud metadata, and RFC1918
addresses.

Decode hex IPv4-mapped suffixes to dotted IPv4 before the private-range
check.

Reported-by: tonghuaroot
This commit is contained in:
SnapOtter
2026-06-06 20:27:48 +08:00
parent 3b84fab765
commit f64cbdda4e
2 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/lib/ssrf.ts
+13 -1
View File
@@ -33,7 +33,19 @@ function isPrivateIPv6(ip: string): boolean {
if (normalized.startsWith("64:ff9b:")) return true;
if (normalized.includes("::ffff:")) {
const v4 = normalized.split("::ffff:")[1];
if (v4 && isPrivateIPv4(v4)) return true;
if (v4) {
if (v4.includes(".")) {
if (isPrivateIPv4(v4)) return true;
} else {
const m = v4.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
if (m) {
const hi = parseInt(m[1], 16);
const lo = parseInt(m[2], 16);
const dotted = `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`;
if (isPrivateIPv4(dotted)) return true;
}
}
}
}
return false;
}
tests/unit/api/ssrf.test.ts
+26
View File
@@ -60,6 +60,32 @@ describe("validateFetchUrl", () => {
await expect(validateFetchUrl("http://255.255.255.255/image.jpg")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 loopback (::ffff:7f00:1)", async () => {
await expect(validateFetchUrl("http://[::ffff:7f00:1]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 metadata (::ffff:a9fe:a9fe)", async () => {
await expect(validateFetchUrl("http://[::ffff:a9fe:a9fe]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 RFC1918 10.x (::ffff:a00:5)", async () => {
await expect(validateFetchUrl("http://[::ffff:a00:5]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 RFC1918 192.168.x (::ffff:c0a8:1)", async () => {
await expect(validateFetchUrl("http://[::ffff:c0a8:1]/")).rejects.toThrow("private");
});
it("rejects hex IPv4-mapped IPv6 RFC1918 172.16.x (::ffff:ac10:1)", async () => {
await expect(validateFetchUrl("http://[::ffff:ac10:1]/")).rejects.toThrow("private");
});
it("rejects dotted IPv4-mapped IPv6 that URL parser canonicalizes to hex", async () => {
await expect(validateFetchUrl("http://[::ffff:127.0.0.1]/")).rejects.toThrow("private");
await expect(validateFetchUrl("http://[::ffff:169.254.169.254]/")).rejects.toThrow("private");
await expect(validateFetchUrl("http://[::ffff:10.0.0.5]/")).rejects.toThrow("private");
});
it("rejects IPv6 unspecified address", async () => {
await expect(validateFetchUrl("http://[::]/image.jpg")).rejects.toThrow("private");
});