mirror of
https://github.com/only-cli/oc.git
synced 2026-09-15 10:40:56 +02:00
only-cli
3ca462e353
PR #5's guard pattern-matched the URL's hostname against a regex, which both under- and over-blocked: IPv4-mapped IPv6 loopback ([::ffff:127.0.0.1]), 0.0.0.0, and any DNS name that merely resolves to a private address all sailed through, while a legitimate public hostname like 10.example.com was wrongly rejected because it starts with "10.". It also only checked the original URL, so a public URL that redirects to an internal address was never re-validated. This replaces the regex with net.isIP + dns.lookup: IP literals are checked directly (including decoding IPv4-mapped/-compatible IPv6), and DNS names are resolved first so every address they point to is validated before connecting. The same check now reruns on every redirect hop for both the impers and native-fetch transports. Resolving before connecting doesn't pin the address for the actual connection (neither impers nor fetch expose that here), so a name that re-resolves differently between this check and the real connect remains a known, documented residual gap.