External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): numeric CIDR matching for IPv6 SSRF allow/deny

Browse Source 
Replace textual prefix matching in isPrivateIPv6() with numeric bit-prefix matching via ipaddr.js. Closes reachable classifier bypasses for IPv4-compatible IPv6 (::a.b.c.d), site-local fec0::/10, and the full fe80::/10 link-local span, on top of the IPv4-mapped forms. Embedded IPv4 (mapped and compatible) is run through the full isPrivateIPv4 classifier; unparseable input fails closed.

Follow-up hardening to f64cbdda.

Reported-by: tonghuaroot
This commit is contained in:
SnapOtter
2026-06-21 23:20:28 +08:00
committed by GitHub
parent 7a3b4e6b3b
commit f75cc328ac
4 changed files with 82 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pnpm-lock.yaml
Generated
+3
View File
@@ -246,6 +246,9 @@ importers:
ioredis:
specifier: ^5.11.1
version: 5.11.1
ipaddr.js:
specifier: ^2.3.0
version: 2.3.0
js-yaml:
specifier: '>=4.2.0'
version: 4.2.0