fix: block private IPv6 URLs (#858)

* fix: block private IPv6 URLs

* fix: cover full fe80::/10 link-local range and :: unspecified

- Replace startsWith("fe80:") with a check covering the full fe80::/10
  range (fe80 through febf) per RFC 4291.
- Add :: (unspecified) to the localhost block.
- Drop the dead 0:0:0:0:0:0:0:1 branch (URL parser normalizes it to ::1).
- Add tests for fe9f::1, febf::1, and ::.

---------

Co-authored-by: dayuan.jiang <jdy.toh@gmail.com>

lib/ssrf-protection.ts

@@ -11,17 +11,38 @@ export function isPrivateUrl(urlString: string): boolean {
         const url = new URL(urlString)
         // Strip a trailing dot so FQDN forms like "localhost." (which still
         // resolve to 127.0.0.1) cannot bypass the equality checks below.
-        const hostname = url.hostname.toLowerCase().replace(/\.$/, "")
+        const hostname = url.hostname
+            .toLowerCase()
+            .replace(/^\[|\]$/g, "")
+            .replace(/\.$/, "")
 
         // Block localhost
         if (
             hostname === "localhost" ||
             hostname === "127.0.0.1" ||
-            hostname === "::1"
+            hostname === "::1" ||
+            hostname === "::"
         ) {
             return true
         }
 
+        // Block IPv6 unique-local (fc00::/7), link-local (fe80::/10),
+        // and IPv4-mapped (::ffff:0:0/96) hosts.
+        if (hostname.includes(":")) {
+            if (
+                hostname.startsWith("fc") ||
+                hostname.startsWith("fd") ||
+                hostname.startsWith("::ffff:")
+            ) {
+                return true
+            }
+            const linkLocal = hostname.match(/^fe([0-9a-f]{2}):/)
+            if (linkLocal) {
+                const high = parseInt(linkLocal[1], 16)
+                if (high >= 0x80 && high <= 0xbf) return true
+            }
+        }
+
         // Block AWS/cloud metadata endpoints
         if (
             hostname === "169.254.169.254" ||