Donal McBreen 9fb419e469 Block IPv6 addresses that reach internal IPs in the unfurl guard ...

The guard blocked the usual private, loopback, and link-local ranges (and
the IPv4-mapped/-compatible IPv6 forms), but let through NAT64, 6to4, and
Teredo addresses, which can point at an internal IPv4, and CGNAT.

Now it pulls the IPv4 out of a NAT64 address and checks that (so NAT64 to a
public site still works), blocks 6to4 and Teredo outright, and adds the
missing IPv4 and IPv6 ranges.

2026-07-20 16:20:15 +01:00

..

rails_ext

Use urlsafe base64 decode

2025-12-02 11:34:12 +01:00

restricted_http

Block IPv6 addresses that reach internal IPs in the unfurl guard

2026-07-20 16:20:15 +01:00