Archives/Athou_commafeed
1
0
Fork 0
mirror of https://github.com/Athou/commafeed.git synced 2026-11-06 04:16:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

block NAT64 local-use prefix in SSRF protection

Browse Source
This commit is contained in:
Athou
2026-11-02 13:09:31 +01:00
parent ddff408afe
commit 01ac8d6ebd
2 changed files with 18 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
View File

@@ -561,6 +561,17 @@ class HttpGetterTest {
() -> getter.get("http://[64:ff9b::a00:1]")); // 10.0.0.1
}
@Test
void nat64LocalUse() {
// 64:ff9b:1::/48 is reserved for local use (RFC 8215), the whole range is blocked
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[64:ff9b:1::a9fe:a9fe]")); // 169.254.169.254
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[64:ff9b:1:ffff::a00:1]")); // 10.0.0.1
}
@Test
void sixToFour() {
// 2002::/16 embeds the IPv4 address in bits 16-47 (RFC 3056)