mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-18 05:02:15 +03:00
71ab289b7a
The #10158 SSRF guard left two gaps on the IPv6 side: an IPv4-mapped IPv6 literal (::ffff:a.b.c.d) skipped IPv4 range checking entirely, and the link-local check only matched strings literally prefixed with "fe80" instead of the full fe80::/10 range (fe80:: - febf:ffff::), so fe90::, febf:ffff::, etc. were wrongly allowed through. isIpv6Blocked() now unwraps mapped IPv4 addresses (both the dotted-quad and WHATWG-normalized hex-group forms) and re-checks them against the IPv4 rules, and link-local detection parses the first hex group's numeric value against the 0xfe80-0xfebf range instead of a string prefix.