Repository navigation
fix: block local-use NAT64 embeddings of private IPv4 addresses - #190
Draft
cursor[bot] wants to merge 6 commits into
Draft
cursor[bot] wants to merge 6 commits into
cursor[bot] wants to merge 6 commits into
Conversation
dns.resolve4/resolve6 ignore /etc/hosts while fetch connects through getaddrinfo. Names such as ip6-localhost therefore skipped the private address check and opened a connection to ::1. Also consult dns.lookup, which uses the same system resolver as fetch. Co-authored-by: Nick Jennings <silverbucket@users.noreply.github.com>
Resolve JSDoc conflict in validateDNSResolution by combining the hosts-file SSRF fix description with master's DNS-based wording. Fix broken Node.js docs link in SECURITY.md (unversioned /api/ URL now 404s). Co-authored-by: Nick Jennings <silverbucket@users.noreply.github.com>
Cherry-pick the DNS-vs-hosts disagreement test from #183, tighten the existing hosts-file test with fetchCalled and a specific error message, and expand JSDoc/SECURITY.md to document NSS and hosts-file overrides. Co-authored-by: Nick Jennings <silverbucket@users.noreply.github.com>
Co-authored-by: Nick Jennings <silverbucket@users.noreply.github.com>
The SSRF check handled the well-known NAT64 prefix 64:ff9b::/96 but not the RFC 8215 local-use prefix 64:ff9b:1::/48. On a network that translates that prefix, an embedded private IPv4 address such as 169.254.169.254 is delivered to that IPv4 host. The /48 layout places the IPv4 address around the reserved octet, not in the last 32 bits. Co-authored-by: Nick Jennings <silverbucket@users.noreply.github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SSRF check rejects private IPv4 addresses embedded in the well-known NAT64 prefix
64:ff9b::/96, but it allows the local-use prefix64:ff9b:1::/48(RFC 8215). On a network that translates that prefix, a lookup or redirect to an address such as64:ff9b:1:a9fe:a9:fe00::is delivered to169.254.169.254. The same path reaches10.0.0.1,127.0.0.1, and other blocked IPv4 ranges.RFC 6052 places the IPv4 address around the reserved octet for a /48 prefix, so it is not in the last 32 bits the way
64:ff9b::/96embeddings are. A non-zero suffix is still translated, so those forms are blocked too. Public embeddings such as64:ff9b:1:808:8:800::(8.8.8.8) stay allowed.Test plan
bunx eslint src/webfinger.ts src/webfinger.test.tsbunx tsc --project tsconfig.dev.json --noEmitbun test ./src/webfinger.test.tsbun test ./spec/integration/local-server.integration.tsfetchhttp://[64:ff9b:1:a9fe:a9:fe00::]/latest/meta-data/is rejected and not followed