fix(security): ignore a malformed CIDR NO_PROXY entry

10.0.0.0/8/junk parsed as /8. An entry with extra segments is dropped like
any other unparseable entry, and the TSDoc says IP entries match within
their address family.

Author: waleedlatif1

apps/sim/lib/core/network/environment-proxy.server.test.ts

@@ -389,6 +389,12 @@ describe('proxy selection from the environment', () => {
       target: 'https://11.0.0.1/',
       proxy: 'http://p:3128/',
     },
+    {
+      case: 'a malformed CIDR NO_PROXY entry is ignored rather than read as its first prefix',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: '10.0.0.0/8/junk' },
+      target: 'https://10.20.30.40/',
+      proxy: 'http://p:3128/',
+    },
     {
       case: 'an IPv6 CIDR NO_PROXY entry excludes addresses inside the range',
       env: { HTTP_PROXY: 'http://p:3128', NO_PROXY: 'fd00::/8' },

packages/security/src/environment-proxy.ts

@@ -41,8 +41,9 @@ function parseNoProxyEntry(entry: string): NoProxyRule | null {
     host = withPort[1]
     port = Number(withPort[2])
   }
-  const [address, prefix] = host.split('/')
+  const [address, prefix, ...rest] = host.split('/')
   const family = ipFamily(address)
+  if (rest.length > 0) return null
   if (!family) return { kind: 'domain', domain: host.replace(/^\*?\./, '').toLowerCase(), port }
   const addresses = new BlockList()
   try {
@@ -74,7 +75,7 @@ function noProxyRules(raw: string): NoProxyRule[] {
  * Whether `NO_PROXY` sends this destination direct, with curl's matching: `*` matches
  * everything; `example.com`, `.example.com` and `*.example.com` all match the domain and
  * every subdomain; `host:port` and `[v6]:port` match only that port; IP entries match any
- * spelling of the address; and `10.0.0.0/8` or `fd00::/8` match IP-literal destinations in
+ * spelling of the address in the same address family; and `10.0.0.0/8` or `fd00::/8` match IP-literal destinations in
  * the range (never a hostname, which is not resolved here).
  */
 function isExcludedByNoProxy(hostname: string, port: number): boolean {