41454756355
80%

Ran 02 Nov 2026 01:40PM UTC

Jobs 11

Files 1201

Run time 1min

Badge

Embed ▾

Committed 02 Nov 2026 01:38PM UTC coverage: 80.073% (-0.03%) from 80.101%

Build # 41454756355

Build Type

push

github

Committed by

web-flow

Commit Message

fix(portal): block Azure WireServer in the SSRF guard (#16177)

The SSRF guard did not block 168.63.129.16, the Azure WireServer
address. It is a public address, so none of the private or special-use
ranges covered it. An admin could point an OIDC or certificate URL at it
and make the portal send a blind request to it.

The guard now blocks it. It is also blocked when it is wrapped in an
IPv6 form.

The metadata addresses of AWS, GCP, Oracle and Alibaba were already
blocked, because they are in link-local, unique-local, or shared address
ranges. The new tests make sure that they stay blocked.

Related:
https://github.com/firezone/firezone/security/advisories/GHSA-9xvg-483p-9fhx

Coverage Stats

1372 of 2287 branches covered (59.99%)

Branch coverage included in aggregate %.

94497 of 117440 relevant lines covered (80.46%)

369147.46 hits per line

Coverage Regressions

Lines	Coverage	∆	File
16	91.92	-5.39%	elixir/lib/portal/entra/sync.ex
10	94.48	-3.45%	elixir/lib/portal/okta/sync.ex
4	97.49	-1.25%	elixir/lib/portal_api/gateway/channel/shared.ex
4	77.31	0.14%	kotlin/android/app/src/main/java/dev/firezone/android/tunnel/TunnelService.kt
3	85.3	-0.96%	elixir/lib/portal_web/live/devices.ex
2	83.68	-0.32%	elixir/lib/portal_web/live_table.ex
1	96.82	-0.11%	elixir/lib/portal_api/client/channel/shared.ex
1	92.12	-0.05%	rust/libs/connlib/tunnel-proto/src/client.rs
1	87.67	-1.37%	elixir/lib/portal/google/webhook_sync.ex
1	96.67	-3.33%	elixir/lib/portal/google/webhooks.ex

Subprojects

ID	Flag name	Job ID	Ran	Files	Coverage
1	rust-fuzz-x509-claims	41454756355.1	02 Nov 2026 01:41PM UTC	4	98.29	GitHub Action Run
2	kotlin-emulator	41454756355.2	02 Nov 2026 01:46PM UTC	132	63.09	GitHub Action Run
3	rust-fuzz-relay-proto	41454756355.3	02 Nov 2026 01:40PM UTC	33	23.64	GitHub Action Run
4	kotlin-test	41454756355.4	02 Nov 2026 01:42PM UTC	132	42.89	GitHub Action Run
5	rust-test-Windows	41454756355.5	02 Nov 2026 01:46PM UTC	246	73.59	GitHub Action Run
6	portal	41454756355.6	02 Nov 2026 01:42PM UTC	654	86.31	GitHub Action Run
7	rust-test-Linux	41454756355.7	02 Nov 2026 01:45PM UTC	270	73.4	GitHub Action Run
8	rust-fuzz-tunnel-proto	41454756355.8	02 Nov 2026 01:46PM UTC	129	87.58	GitHub Action Run
9	rust-fuzz-ip-packet	41454756355.9	02 Nov 2026 01:40PM UTC	16	75.49	GitHub Action Run
10	rust-test-macOS	41454756355.10	02 Nov 2026 01:46PM UTC	218	75.21	GitHub Action Run
11	swift-test	41454756355.11	02 Nov 2026 01:41PM UTC	63	45.46	GitHub Action Run

firezone / firezone / 41454756355
80%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Subprojects

Source Files on build 41454756355

firezone / firezone / 41454756355 80%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Subprojects

Source Files on build 41454756355

firezone / firezone / 41454756355
80%

README BADGES
x