public/once-campfire
1
0
Fork 0
mirror of https://github.com/basecamp/once-campfire.git synced 2026-08-07 15:28:45 +09:00
Code Issues Packages Projects Releases Wiki Activity

Remove IPv4 ranges the IPAddr predicates already cover

Browse Source 
The RFC1918, loopback, and link-local ranges in DISALLOWED_IPV4
duplicated the private?/loopback?/link_local? checks that run right
before the list scan, so they could never be the deciding factor. Keep
only the ranges the predicates don't catch.
This commit is contained in:
Donal McBreen
2026-07-21 11:37:17 +01:00
parent 4cfcc2a370
commit 80fdd44622
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/restricted_http/private_network_guard.rb
+3 -5
View File
@@ -6,12 +6,10 @@ module RestrictedHTTP
module PrivateNetworkGuard
extend self
# IPv4 ranges that must never be a fetch target (RFC 5735/6890 special-use,
# plus CGNAT and benchmarking). RFC1918/loopback/link-local are also covered
# by the IPAddr predicates in #disallowed_ipv4?.
# IPv4 special-use ranges (RFC 5735/6890) not already covered by the
# private?/loopback?/link_local? predicates in #disallowed_ipv4?.
DISALLOWED_IPV4 = %w[
0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 192.168.0.0/16
0.0.0.0/8 100.64.0.0/10 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24
198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/4 240.0.0.0/4
].map { |cidr| IPAddr.new(cidr) }.freeze