CalvinBackup/gstack
1
0
Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-07-08 00:58:05 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(browse): block direct IPv6 link-local navigation

Browse Source 
URL validation centralises link-local (fe80::/10) into BLOCKED_IPV6_PREFIXES
alongside ULA (fc00::/7), so direct `http://[fe80::N]/` URLs are rejected
the same way `http://[fc00::]/` already was. Previously the link-local
guard only fired during DNS AAAA resolution, leaving direct-literal URLs
to slip through.

Prefix range covers fe80::-febf::: ['fe8','fe9','fea','feb'].

Regression test: validateNavigationUrl('http://[fe80::2]/') now throws
with /cloud metadata/i.

Contributed by @hiSandog (#1249).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Garry Tan
2026-05-10 11:06:43 -07:00
parent 38383f4b06
commit 6896f8b429
2 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
browse/test/url-validation.test.ts
+4
View File
@@ -99,6 +99,10 @@ describe('validateNavigationUrl', () => {
await expect(validateNavigationUrl('http://[fc00::]/')).rejects.toThrow(/cloud metadata/i);
});
it('blocks direct IPv6 link-local addresses', async () => {
await expect(validateNavigationUrl('http://[fe80::2]/')).rejects.toThrow(/cloud metadata/i);
});
it('does not block hostnames starting with fd (e.g. fd.example.com)', async () => {
await expect(validateNavigationUrl('https://fd.example.com/')).resolves.toBe('https://fd.example.com/');
});