4 Commits

Author	SHA1	Message	Date
Donal McBreen	9fb419e469	Block IPv6 addresses that reach internal IPs in the unfurl guard ... The guard blocked the usual private, loopback, and link-local ranges (and the IPv4-mapped/-compatible IPv6 forms), but let through NAT64, 6to4, and Teredo addresses, which can point at an internal IPv4, and CGNAT. Now it pulls the IPv4 out of a NAT64 address and checks that (so NAT64 to a public site still works), blocks 6to4 and Teredo outright, and adds the missing IPv4 and IPv6 ranges.	2026-07-20 16:20:15 +01:00
Jeremy Daer	e983e3f79f	Block IPv6 SSRF bypass via ipv4_compat addresses (#153) ... Adds ipv4_mapped? and ipv4_compat? checks to PrivateNetworkGuard.private_ip? to block SSRF bypass attempts using IPv6 address formats like: - ::ffff:169.254.169.254 (IPv4-mapped) - ::169.254.169.254 (IPv4-compatible) These formats could previously bypass the link_local? check since Ruby treats them as IPv6 addresses, not IPv4. Ref: HackerOne #3481701	2025-12-31 13:01:43 -08:00
Stanko K.R.	4d04f9beee	Use urlsafe base64 decode	2025-12-02 11:34:12 +01:00
Stanko K.R.	bebe518c74	Parse Rails 7 GIDs	2025-12-02 11:06:23 +01:00