mirror of
https://github.com/Crosstalk-Solutions/project-nomad.git
synced 2026-03-29 04:59:26 +02:00
05893d7ab9
The assertNotPrivateUrl() function blocked standard loopback and link-local addresses but could be bypassed using IPv4-mapped IPv6 representations: - http://[::ffff:127.0.0.1]:8080/ → loopback bypass - http://[::ffff:169.254.169.254]:8080/ → metadata endpoint bypass - http://[::]:8080/ → all-interfaces bypass Node.js normalises these to [::ffff:7f00:1], [::ffff:a9fe:a9fe], and [::] respectively, none of which matched the existing regex patterns. Add two patterns to close the gap: - /^\[::ffff:/i catches all IPv4-mapped IPv6 addresses - /^\[::\]$/ catches the IPv6 all-zeros address Legitimate RFC1918 LAN URLs (192.168.x, 10.x, 172.16-31.x) remain allowed. |
||
|---|---|---|
| .. | ||
| app | ||
| bin | ||
| commands | ||
| config | ||
| constants | ||
| database | ||
| docs | ||
| inertia | ||
| providers | ||
| public | ||
| resources/views | ||
| start | ||
| tests | ||
| types | ||
| util | ||
| views | ||
| .editorconfig | ||
| .env.example | ||
| ace.js | ||
| adonisrc.ts | ||
| eslint.config.js | ||
| package-lock.json | ||
| package.json | ||
| tailwind.config.ts | ||
| tsconfig.json | ||
| vite.config.ts | ||