openhands b870b5d41b fix(security): close SSRF guard bypasses in ssrfGuard.js (#3714) ...

Closes four SSRF guard bypasses reported in #3714:
- Block alternate IPv6 encodings (hex format, NAT64, IPv4-compatible, IPv4-mapped) by parsing to 16-bit groups
- Normalize trailing dots on hostnames to prevent FQDN bypasses
- Add assertPublicUrlResolved() with DNS resolution to block wildcard DNS domains resolving to private/metadata IPs
- Add fetchPublic() to safely handle and validate HTTP redirects

2026-09-03 09:22:22 +07:00

6.9 KiB

Raw Permalink Blame History

View Raw