mirror of
https://github.com/penpot/penpot.git
synced 2026-09-02 01:59:17 +00:00
326d83e780
* 🐛 Block IPv6 transition addresses in SSRF guard The outbound HTTP SSRF blocklist did not classify NAT64 (64:ff9b::/96), 6to4 (2002::/16) or Teredo (2001:0000::/32) addresses, whose embedded IPv4 target is invisible to the JVM InetAddress predicates, so URLs resolving to them could reach cloud metadata, loopback or RFC 1918 hosts from webhook delivery and media import. Transition ranges are now rejected outright and any embedded IPv4 is re-checked against the full blocklist, including operator-supplied extra blocked CIDRs. Closes #11319 * ♻️ Remove dead embedded-IPv4 re-check from SSRF guard The previous commit added a recursive re-check of the IPv4 embedded in NAT64/6to4/Teredo addresses, but the `or` in `blocked-address?` short-circuits on the truthy keyword returned by `transition-prefix`, so the embedded-IPv4 branch was unreachable. The transition ranges are already rejected outright (fail-closed), making the re-check both unnecessary and untested. Remove `transition-embedded-ipv4`, simplify the IPv6 branch to a plain prefix check, and correct the docstrings and tests to match what the code actually does. AI-assisted-by: glm-5.3-flash