Jeremy Daer ae7a34113f Block IPv6 encapsulation and CGNAT ranges in SSRF guard ...

Add NAT64 (64:ff9b::/96), 6to4 (2002::/16), and CGNAT shared address
space (100.64.0.0/10) to the private-network guard. These ranges can
smuggle requests toward internal networks and were not covered by the
existing predicates, leaving an SSRF bypass. Introduce DISALLOWED_RANGES
and OR it into private_ip?, preserving LOCAL_IP behavior.

Ref: weekend run #3873122 (IPv6 encapsulation SSRF ranges)

2026-07-20 02:17:12 -07:00

..

rails_ext

Use urlsafe base64 decode

2025-12-02 11:34:12 +01:00

restricted_http

Block IPv6 encapsulation and CGNAT ranges in SSRF guard

2026-07-20 02:17:12 -07:00