Kikobeats / is-local-address / 36696385994

100%

push

github

fix: match IPv6 hex digits case-insensitively (#33)

* fix: match IPv6 hex digits case-insensitively

IPv6 hex is case-insensitive (RFC 4291 2.2), but the per-range /i flags
were lost when the sources were joined into one regex, so raw uppercase
input like FE80::1, FC00::1, FF02::1, 2001:DB8::1 or ::FFFF:127.0.0.1
returned false: a false negative for an SSRF guard. new URL() lowercases,
so URL-based callers were not affected.

The joined regex is now compiled with the i flag. site-scoped passes its
dotted-or-hex mapped IPv4 decoder into the matcher instead of wrapping it,
which also stops it stripping brackets twice ([[::1]] was true there and
false in the default export).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci(redos): check the real regex source and flags

The scripts passed String(regex), so redos-detector analyzed a pattern
starting with a literal '/' and never saw the i flag. Pass .source with
--caseInsensitive and also check the site-scoped IPv6 regex.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

32 of 32 branches covered (100.0%)

Branch coverage included in aggregate %.

24 of 24 new or added lines in 3 files covered. (100.0%)

158 of 158 relevant lines covered (100.0%)

61.96 hits per line