bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-13 22:37:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Block IPv6 unspecified feed URLs (#15)

Browse source
This commit is contained in:
Autowebassat-blip 2026-06-12 06:06:03 +02:00 • committed by GitHub
parent 9942ef8dc6
commit 73e2464b30
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
plugins/feed-discovery/src/feed-discovery.test.ts
View file

@ -50,6 +50,7 @@ describe("site probing helpers", () => {
it("blocks private SSRF targets", async () => { it("blocks private SSRF targets", async () => {
await expect(assertSafeHttpUrl("http://127.0.0.1/feed")).rejects.toThrow(/Blocked internal/); await expect(assertSafeHttpUrl("http://127.0.0.1/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("http://[::]/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("http://[::ffff:192.168.1.10]/feed")).rejects.toThrow(/Blocked internal/); await expect(assertSafeHttpUrl("http://[::ffff:192.168.1.10]/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("file:///etc/passwd")).rejects.toThrow(/Unsupported URL protocol/); await expect(assertSafeHttpUrl("file:///etc/passwd")).rejects.toThrow(/Unsupported URL protocol/);
}); });

1
plugins/feed-discovery/src/url-safety.ts
View file

@ -78,6 +78,7 @@ function isBlockedIp(value: string) {
return isBlockedIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`); return isBlockedIp(`${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`);
} }
return ( return (
normalized === "::" ||
normalized === "::1" || normalized === "::1" ||
normalized.startsWith("fc") || normalized.startsWith("fc") ||
normalized.startsWith("fd") || normalized.startsWith("fd") ||