SnapOtter f64cbdda4e fix: block hex IPv4-mapped IPv6 in SSRF guard ...

The WHATWG URL parser canonicalizes dotted IPv4-mapped IPv6 literals
(e.g. ::ffff:127.0.0.1) to hex form (::ffff:7f00:1). The SSRF guard
only checked the dotted form, so hex literals bypassed the private-IP
classifier and allowed access to loopback, cloud metadata, and RFC1918
addresses.

Decode hex IPv4-mapped suffixes to dotted IPv4 before the private-range
check.

Reported-by: tonghuaroot

2026-06-06 20:27:48 +08:00

..

benchmark

chore: deploy to Cloudflare Pages and update branding

2026-04-24 18:06:29 +08:00

e2e

test: expand test coverage across all layers (+1,157 tests)

2026-06-06 19:37:29 +08:00

e2e-analytics

test: massive test coverage expansion (+1,437 tests, 22 new files)

2026-05-09 09:02:29 +08:00

e2e-docker

test: expand test coverage across all layers (+1,157 tests)

2026-06-06 19:37:29 +08:00

e2e-docs

fix: replace hardcoded "52 tools" with "50+" across all copy

2026-05-20 14:45:45 +08:00

e2e-editor

test: massive test coverage expansion (+1,437 tests, 22 new files)

2026-05-09 09:02:29 +08:00

e2e-landing

fix: replace hardcoded "52 tools" with "50+" across all copy

2026-05-20 14:45:45 +08:00

fixtures

chore: add pre-push hook guard and test scene fixture

2026-05-18 10:20:12 +08:00

integration

feat: add enterprise licensing and S3 storage backend

2026-06-06 20:17:49 +08:00

unit

fix: block hex IPv4-mapped IPv6 in SSRF guard

2026-06-06 20:27:48 +08:00