microlinkhq / unavatar / 32350314292

97%

push

github

fix: refuse hosts that resolve any reserved address (#642)

isReservedIp only inspected the first DNS answer. Node's default
autoSelectFamily lookup uses all addresses, so a public A/AAAA followed
by a link-local or loopback record could pass the guard and still be
the hop got connects to.

Resolve with { all: true } and treat the host as reserved when any
answer is non-unicast.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: kikohumanbeatbox <kikohumanbeatbox@gmail.com>

843 of 905 branches covered (93.15%)

Branch coverage included in aggregate %.

9 of 9 new or added lines in 1 file covered. (100.0%)

3073 of 3127 relevant lines covered (98.27%)

6.25 hits per line