mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-09-01 17:10:24 +08:00
410993a3bf
* fix: block private IPv6 URLs
* fix: cover full fe80::/10 link-local range and :: unspecified
- Replace startsWith("fe80:") with a check covering the full fe80::/10
range (fe80 through febf) per RFC 4291.
- Add :: (unspecified) to the localhost block.
- Drop the dead 0:0:0:0:0:0:0:1 branch (URL parser normalizes it to ::1).
- Add tests for fe9f::1, febf::1, and ::.
---------
Co-authored-by: dayuan.jiang <jdy.toh@gmail.com>
22 lines
947 B
TypeScript
22 lines
947 B
TypeScript
import { describe, expect, it } from "vitest"
|
|
import { isPrivateUrl } from "@/lib/ssrf-protection"
|
|
|
|
describe("isPrivateUrl", () => {
|
|
it("blocks private IPv6 URLs", () => {
|
|
expect(isPrivateUrl("http://[::1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[0:0:0:0:0:0:0:1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[::]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[::ffff:127.0.0.1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[fc00::1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[fd12:3456:789a::1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[fe80::1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[fe9f::1]/")).toBe(true)
|
|
expect(isPrivateUrl("http://[febf::1]/")).toBe(true)
|
|
})
|
|
|
|
it("allows public URLs", () => {
|
|
expect(isPrivateUrl("https://example.com/article")).toBe(false)
|
|
expect(isPrivateUrl("https://fc00.example.com/article")).toBe(false)
|
|
})
|
|
})
|