5 Commits

Author	SHA1	Message	Date
Donal McBreen	9fb419e469	Block IPv6 addresses that reach internal IPs in the unfurl guard ... The guard blocked the usual private, loopback, and link-local ranges (and the IPv4-mapped/-compatible IPv6 forms), but let through NAT64, 6to4, and Teredo addresses, which can point at an internal IPv4, and CGNAT. Now it pulls the IPv4 out of a NAT64 address and checks that (so NAT64 to a public site still works), blocks 6to4 and Teredo outright, and adds the missing IPv4 and IPv6 ranges.	2026-07-20 16:20:15 +01:00
Jeremy Daer	e983e3f79f	Block IPv6 SSRF bypass via ipv4_compat addresses (#153) ... Adds ipv4_mapped? and ipv4_compat? checks to PrivateNetworkGuard.private_ip? to block SSRF bypass attempts using IPv6 address formats like: - ::ffff:169.254.169.254 (IPv4-mapped) - ::169.254.169.254 (IPv4-compatible) These formats could previously bypass the link_local? check since Ruby treats them as IPv6 addresses, not IPv4. Ref: HackerOne #3481701	2025-12-31 13:01:43 -08:00
Stanko K.R.	0672673916	Disallow SSRF via IPv6 addresses mapped to IPv4 addresses	2025-12-03 08:08:34 +01:00
Jeremy Daer	5667262d1c	Security: disallow blind SSRF to link-local IPs via URL unfurling	2025-12-02 21:33:44 -08:00
Kevin McConnell	df76a227dc	Hello world ... First open source release of Campfire 🎉	2025-08-21 09:31:59 +01:00