stacklok / toolhive / 31403992092

71%

Build Type

push

github

Committed by web-flow

Commit Message

Extend private-IP guard to 6to4/Teredo addresses (#6249)

The SSRF guard already decoded NAT64-embedded IPv4 targets but
treated 6to4 and Teredo - two other IPv6 transition address families
that also embed an IPv4 destination - as ordinary public addresses.

Decode 6to4 the same way as NAT64, recursing into the classifier on
the embedded IPv4. Block Teredo wholesale instead, since its embedded
IPv4 is obfuscated via bitwise NOT and can't be reliably decoded from
the address alone.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Coverage Stats

12 of 13 new or added lines in 1 file covered. (92.31%)

12 existing lines in 4 files now uncovered.

83901 of 119610 relevant lines covered (70.15%)

98.67 hits per line