fix: block private IPv6 URLs (#858)

* fix: block private IPv6 URLs

* fix: cover full fe80::/10 link-local range and :: unspecified

- Replace startsWith("fe80:") with a check covering the full fe80::/10
  range (fe80 through febf) per RFC 4291.
- Add :: (unspecified) to the localhost block.
- Drop the dead 0:0:0:0:0:0:0:1 branch (URL parser normalizes it to ::1).
- Add tests for fe9f::1, febf::1, and ::.

---------

Co-authored-by: dayuan.jiang <jdy.toh@gmail.com>

tests/unit/ssrf-protection.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from "vitest"
+import { isPrivateUrl } from "@/lib/ssrf-protection"
+
+describe("isPrivateUrl", () => {
+    it("blocks private IPv6 URLs", () => {
+        expect(isPrivateUrl("http://[::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[0:0:0:0:0:0:0:1]/")).toBe(true)
+        expect(isPrivateUrl("http://[::]/")).toBe(true)
+        expect(isPrivateUrl("http://[::ffff:127.0.0.1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fc00::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fd12:3456:789a::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fe80::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[fe9f::1]/")).toBe(true)
+        expect(isPrivateUrl("http://[febf::1]/")).toBe(true)
+    })
+
+    it("allows public URLs", () => {
+        expect(isPrivateUrl("https://example.com/article")).toBe(false)
+        expect(isPrivateUrl("https://fc00.example.com/article")).toBe(false)
+    })
+})