luulam/9router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ssrf): block IPv6-mapped IPv4 addresses (GHSA-hj98-rc6w-m8cw)

Browse Source 
isBlockedIpv6() did not normalize ::ffff:<ipv4>, allowing the SSRF
filter to be bypassed. Extract and validate via isBlockedIpv4().

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
decolua
2026-06-26 12:14:30 +07:00
parent 3a866fe18d
commit 8ac631d615
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/shared/utils/ssrfGuard.js
View File

@@ -38,6 +38,8 @@ function isBlockedIpv4(host) {
function isBlockedIpv6(host) { function isBlockedIpv6(host) {
const h = host.replace(/^\[|\]$/g, "").toLowerCase(); const h = host.replace(/^\[|\]$/g, "").toLowerCase();
const v4Mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
if (v4Mapped) return isBlockedIpv4(v4Mapped[1]);
if (h === "::1" || h === "::") return true; if (h === "::1" || h === "::") return true;
return h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd"); return h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd");
} }