Add test coverage for standard NAT64 prefix and IPv4-mapped IPv6 in SSRF protection - #8041
Open
presendapp wants to merge 1 commit into
Open
presendapp wants to merge 1 commit into
presendapp wants to merge 1 commit into
Conversation
isBlockedIP() already handles both cases correctly (the rfc6052 range check for the standard 64:ff9b::/96 NAT64 prefix, and the explicit isIPv4MappedAddress() unwrap-and-recheck for ::ffff:x.x.x.x), but neither had an explicit test naming them -- only the RFC 8215 local-use NAT64 variant (64:ff9b:1::/48) was covered. Added 3 cases: the standard NAT64 prefix, an IPv4-mapped IPv6 loopback (should block), and an IPv4-mapped IPv6 public address (should allow, to confirm the check isn't overly broad and only unwraps to recheck the embedded IPv4, not blocking every mapped address outright). All 17 tests (14 existing + 3 new) pass locally with mocha 10.8.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
isBlockedIP() already handles both cases correctly -- the
rfc6052range check for the standard64:ff9b::/96NAT64 prefix, and the explicitisIPv4MappedAddress()unwrap-and-recheck for::ffff:x.x.x.x-- but neither had an explicit test naming them. Only the RFC 8215 local-use NAT64 variant (64:ff9b:1::/48) was covered.Added 3 cases:
All 17 tests (14 existing + 3 new) pass locally with mocha 10.8.2. No behavior change, test coverage only.