Block IPv4-compatible IPv6 feed URLs (#32)

Co-authored-by: Codex Microtask Operator <codex-microtask@example.com>
This commit is contained in:
Autowebassat-blip 2026-06-14 07:58:57 +02:00 • committed by GitHub
parent 307095d5e9
commit 774d461db6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 11 additions and 0 deletions

View file

@ -63,6 +63,7 @@ describe("site probing helpers", () => {
await expect(assertSafeHttpUrl("http://127.0.0.1/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("http://[::]/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("http://[::ffff:192.168.1.10]/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("http://[::192.168.1.10]/feed")).rejects.toThrow(/Blocked internal/);
await expect(assertSafeHttpUrl("file:///etc/passwd")).rejects.toThrow(/Unsupported URL protocol/);
});