Jeremy Daer ae7a34113f Block IPv6 encapsulation and CGNAT ranges in SSRF guard ...

Add NAT64 (64:ff9b::/96), 6to4 (2002::/16), and CGNAT shared address
space (100.64.0.0/10) to the private-network guard. These ranges can
smuggle requests toward internal networks and were not covered by the
existing predicates, leaving an SSRF bypass. Introduce DISALLOWED_RANGES
and OR it into private_ip?, preserving LOCAL_IP behavior.

Ref: weekend run #3873122 (IPv6 encapsulation SSRF ranges)

2026-07-20 02:17:12 -07:00

..

assets

Hello world

2025-08-21 09:31:59 +01:00

rails_ext

Try to decode SGIDs in multiple ways

2025-12-15 17:00:50 +01:00

restricted_http

Block IPv6 encapsulation and CGNAT ranges in SSRF guard

2026-07-20 02:17:12 -07:00

tasks

Upgrade to Rails 8 and Ruby 3.4.5 (#1)

2025-09-02 17:02:41 +02:00

web_push

Hello world

2025-08-21 09:31:59 +01:00