admins/lms-sb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Block v4-mapped IPv6 literals in SSRF validator

Browse Source
This commit is contained in:
admins
2026-07-06 11:37:05 +05:00
parent 2c619be043
commit 9a74339087
2 changed files with 60 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/clean-pdf/__tests__/ssrf.test.ts
+13 -1
View File
@@ -7,8 +7,9 @@ describe("isPrivateAddress", () => {
"172.16.0.1", "172.31.255.255", "192.168.1.1", "192.0.0.8", "198.18.0.1",
"224.0.0.1", "255.255.255.255",
"::1", "::", "fc00::1", "fd12:3456::1", "fe80::1", "::ffff:10.0.0.1", "::ffff:127.0.0.1",
"::ffff:7f00:1", "::ffff:a00:1", "::ffff:c0a8:101", "::ffff:a9fe:a9fe",
];
const publicIps = ["93.184.216.34", "8.8.8.8", "172.32.0.1", "2606:2800:220:1::1", "::ffff:8.8.8.8"];
const publicIps = ["93.184.216.34", "8.8.8.8", "172.32.0.1", "2606:2800:220:1::1", "::ffff:8.8.8.8", "::ffff:808:808"];
it.each(privateIps)("блокирует %s", (ip) => expect(isPrivateAddress(ip)).toBe(true));
it.each(publicIps)("пропускает %s", (ip) => expect(isPrivateAddress(ip)).toBe(false));
@@ -55,4 +56,15 @@ describe("assertPublicUrl", () => {
const failResolve = async () => { throw new Error("ENOTFOUND"); };
await expect(assertPublicUrl("https://nope.example/x", failResolve)).rejects.toThrow(BlockedUrlError);
});
it("блокирует v4-mapped IPv6 в bracket-нотации (SSRF-обход)", async () => {
for (const raw of [
"http://[::ffff:127.0.0.1]/",
"http://[::ffff:10.0.0.1]/",
"http://[::ffff:169.254.169.254]/",
"http://[::ffff:192.168.1.1]/",
]) {
await expect(assertPublicUrl(raw, publicResolve)).rejects.toThrow(BlockedUrlError);
}
});
});