diff options
| author | Adam Soltys <[email protected]> | 2026-09-25 15:15:19 -0700 |
|---|---|---|
| committer | Adam Soltys <[email protected]> | 2026-09-25 15:15:19 -0700 |
| commit | cd5c18867a3b6764cd2b6108906b40b4578a65b4 (patch) | |
| tree | 6c4755bebfbc7a37feb1d08faf347818587b14d8 /lib/webhooks.js.map | |
| parent | bd54987e1f2d708f7e9c5e6e903bcd3c4502b495 (diff) | |
| download | coinos-server-cd5c18867a3b6764cd2b6108906b40b4578a65b4.tar.gz coinos-server-cd5c18867a3b6764cd2b6108906b40b4578a65b4.zip | |
safe-fetch: decode IPv6 hosts before checking for private addresses
URL parsing serializes IPv6 hosts in hex, so an IPv4-mapped address never
matched the dotted-quad pattern and passed as public. Expand the address and
judge every form that embeds an IPv4 address by that address, and block the
remaining non-public IPv6 ranges.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Diffstat (limited to 'lib/webhooks.js.map')
0 files changed, 0 insertions, 0 deletions