SnapOtterandGitHub f75cc328ac fix(security): numeric CIDR matching for IPv6 SSRF allow/deny ...

Replace textual prefix matching in isPrivateIPv6() with numeric bit-prefix matching via ipaddr.js. Closes reachable classifier bypasses for IPv4-compatible IPv6 (::a.b.c.d), site-local fec0::/10, and the full fe80::/10 link-local span, on top of the IPv4-mapped forms. Embedded IPv4 (mapped and compatible) is run through the full isPrivateIPv4 classifier; unparseable input fails closed.

Follow-up hardening to f64cbdda.

Reported-by: tonghuaroot

2026-06-21 23:20:28 +08:00

..

ai

fix(ai): broaden SSRF pre-scan regex to cover srcset, poster, formaction, @import

2026-06-13 10:36:12 +08:00

api

fix(security): numeric CIDR matching for IPv6 SSRF allow/deny

2026-06-21 23:20:28 +08:00

doc-engine

feat(tools): 2.0 phase 5 wave 4 - office, ebooks, data, archives (14 tools) (#224)

2026-06-13 10:19:11 +08:00

features

test: fix stale feature-manifest assertions (bundleRepo rename, unpublished extractedSize)

2026-06-19 20:03:26 +08:00

fixtures

test(fixtures): update manifest provenance, LICENSES, and parity baseline

2026-06-20 01:04:47 +08:00

image-engine

test: reorganize flat test files into purpose-based subdirectories (phase 6)

2026-06-20 05:07:46 +08:00

media-engine

feat(tools): 2.0 phase 5 wave 3a - video depth (22 tools) (#221)

2026-06-13 10:19:00 +08:00

scripts

chore: section-prefix remaining tool paths in docs, examples, benchmarks, and multi-input test

2026-06-21 00:30:10 +08:00

security

Merge branch 'worktree-test+suite-overhaul-and-real-fixtures' into chore/consolidate-v2.0.0

2026-06-21 02:18:53 +08:00

shared

Merge branch 'worktree-test+suite-overhaul-and-real-fixtures' into chore/consolidate-v2.0.0

2026-06-21 02:18:53 +08:00

web

Merge branch 'worktree-test+suite-overhaul-and-real-fixtures' into chore/consolidate-v2.0.0

2026-06-21 02:18:53 +08:00