Archives/Athou_commafeed
1
0
Fork 1
mirror of https://github.com/Athou/commafeed.git synced 2026-09-22 12:04:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

more SSRF protection regarding IPv6

Browse Source
This commit is contained in:
Athou
2026-08-11 07:46:02 +02:00
parent ba454322db
commit 76a92ea44c
2 changed files with 76 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
commafeed-server/src/test/java/com/commafeed/backend/HttpGetterTest.java
View File

@@ -547,5 +547,47 @@ class HttpGetterTest {
Assertions.assertThrows(
UnknownHostException.class, () -> getter.get("http://[fd00:dead:beef::50]"));
}
@Test
void nat64() {
// 64:ff9b::/96 embeds the IPv4 address in the lower 32 bits (RFC 6052)
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[64:ff9b::a9fe:a9fe]")); // 169.254.169.254
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[64:ff9b::a00:1]")); // 10.0.0.1
}
@Test
void sixToFour() {
// 2002::/16 embeds the IPv4 address in bits 16-47 (RFC 3056)
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[2002:a9fe:a9fe::]")); // 169.254.169.254
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[2002:a00:1::]")); // 10.0.0.1
}
@Test
void teredo() {
// 2001:0000::/32 embeds the obfuscated (bitwise NOT) IPv4 address in the lower 32
// bits (RFC 4380)
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[2001:0:4136:e378:8000:63bf:f5ff:fffe]")); // 10.0.0.1
}
@Test
void ipv4Compatible() {
// deprecated ::/96 IPv4-compatible addresses embed the IPv4 address in the lower 32
// bits
Assertions.assertThrows(
UnknownHostException.class,
() -> getter.get("http://[::a9fe:a9fe]")); // 169.254.169.254
Assertions.assertThrows(
UnknownHostException.class, () -> getter.get("http://[::a00:1]")); // 10.0.0.1
}
}
}