Superminaren/hackerspace.sh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(door): block hex IPv4-mapped IPv6 in the SSRF filter (M3)

Browse Source 
isBlockedDoorIp blocked the dotted IPv4-mapped form (::ffff:169.254.169.254)
but the hex form ::ffff:a9fe:a9fe (=169.254.169.254 IMDS) / ::ffff:7f00:1
(=127.0.0.1) fell through the IPv6 branch and returned false. Decode the hex
IPv4-mapped form to dotted IPv4 and run the existing blocked-range checks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Moheeb Zara
2026-08-01 21:31:34 -07:00
co-authored by Claude Opus 4.8
parent f337a85682
commit a3e9b97292
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
__tests__/door-logic.test.ts
+12
View File
@@ -44,6 +44,18 @@ describe('isBlockedDoorIp (resolved-IP DNS-rebind guard)', () => {
expect(isBlockedDoorIp(ip)).toBe(true)
}
})
it('blocks the HEX IPv4-mapped form (::ffff:HHHH:HHHH) too', () => {
// ::ffff:a9fe:a9fe == 169.254.169.254 (IMDS); ::ffff:7f00:1 == 127.0.0.1
for (const ip of ['::ffff:a9fe:a9fe', '::ffff:7f00:1', '::ffff:7f00:0001', '::ffff:a9fe:0102', '[::ffff:7f00:1]']) {
expect(isBlockedDoorIp(ip)).toBe(true)
}
})
it('ALLOWS non-blocked ranges in HEX IPv4-mapped form', () => {
// ::ffff:c0a8:0109 == 192.168.1.9 ; ::ffff:cb00:7107 == 203.0.113.7
for (const ip of ['::ffff:c0a8:0109', '::ffff:cb00:7107']) {
expect(isBlockedDoorIp(ip)).toBe(false)
}
})
it('ALLOWS RFC1918 / LAN / ULA / public (door controllers live there)', () => {
for (const ip of ['10.0.0.5', '172.16.4.4', '192.168.1.50', '203.0.113.7', 'fd12:3456::1', '2001:db8::1', '::ffff:192.168.1.9']) {
expect(isBlockedDoorIp(ip)).toBe(false)