Kikobeats / is-local-address / 36709146405

100%

push

github

fix(ipv6): canonicalize before matching, classify embedded IPv4 (#34)

* fix(ipv6): canonicalize before matching, classify embedded IPv4

IPv6 input is canonicalized with the WHATWG URL parser before matching,
so every spelling of an address gets the same answer (dotted or hex
tail, compressed or not, any case, with a zone id).

- IPv4-mapped (::ffff:0:0/96) and NAT64 (64:ff9b::/96, default export)
  addresses classify by the embedded IPv4, where a connection ends up:
  64:ff9b::a00:1 (what new URL() gives for 64:ff9b::10.0.0.1) was false,
  ::ffff:8.8.8.8 was true.
- IPv6-looking input that cannot be parsed fails closed: local in the
  default export, not site-scoped in /site-scoped. macOS getaddrinfo
  accepts spellings URL rejects (::ffff:127.0.0.01 reaches loopback), so
  rejecting them as public would be an SSRF bypass.
- 100::/64 matched addresses outside the /64 (100::1:2:3:4:5).
- null/undefined and non-string primitives throw TypeError; objects and
  arrays are coerced with String().

Closes #29
Closes #30

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: document IPv6 spellings, embedded IPv4 and real bundle size

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore(benchmark): regenerate

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

53 of 53 branches covered (100.0%)

Branch coverage included in aggregate %.

55 of 55 new or added lines in 4 files covered. (100.0%)

185 of 185 relevant lines covered (100.0%)

169.59 hits per line