Skip to content

Improve IPv6 address validation logic #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
HackingRepo merged 1 commit into from
Apr 27, 2026
Merged

Improve IPv6 address validation logic #79

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 28 additions & 5 deletions dist/helpers.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,9 +221,32 @@ function is_ip_internal(ip) {
}
if (parsed.kind() === "ipv6") {
const range = parsed.range();
return (range === "loopback" ||
range === "linkLocal" ||
range === "uniqueLocal");
if (range !== "unicast") {
// Check for IPv4-mapped or IPv4-compatible addresses
if (range === "ipv4Mapped" || range === "rfc6145") {
try {
// @ts-ignore
const ipv4 = parsed.toIPv4Address();
return is_ip_internal(ipv4.toString());
}
catch {
return true;
}
}
return true;
}
// Additional manual blocks for IPv6
const extraBadRanges = [
ipaddr.parseCIDR("64:ff9b:1::/48"),
ipaddr.parseCIDR("5f00::/8"),
ipaddr.parseCIDR("3fff::/20"),
ipaddr.parseCIDR("fec0::/10"),
];
for (const [range, bits] of extraBadRanges) {
// @ts-ignore
if (parsed.match(range, bits))
return true;
}
Comment on lines +224 to +249
Copy link
Copy Markdown

@qodo-code-review qodo-code-review Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

1. Dist/source logic diverges 🐞 Bug ⛨ Security

The IPv6/URL hostname hardening was applied only in dist/helpers.js, while src/helpers.ts still
contains the old logic; running tsc (the project build) will overwrite dist and drop the fix. Code
paths importing from src/ (e.g., benches) will also continue using the old behavior, undermining
the intended GHSA fix.
Agent Prompt 
### Issue description
Security-related IPv6/hostname validation changes were made directly in the generated file `dist/helpers.js` only. The authoritative source `src/helpers.ts` still has the previous behavior, so `npm run build` (`tsc`) will overwrite the fix and internal repo imports from `src/` will remain vulnerable.

### Issue Context
- `tsconfig.json` outputs to `dist` and includes only `src`.
- `package.json` build script is `tsc`.
- Benchmarks import from `../src/utils`.

### Fix Focus Areas
- src/helpers.ts[224-243]
- src/helpers.ts[482-520]
- dist/helpers.js[215-252]
- dist/helpers.js[425-460]

### What to do
1. Implement the same IPv6 validation logic (including IPv4-mapped handling + extra blocked ranges) in `src/helpers.ts:is_ip_internal`.
2. Apply the same hostname normalization (`parsed.hostname.replace(...)`) in `src/helpers.ts:is_url_safe` (and debug variant if intended).
3. Re-run `npm run build` to regenerate `dist/` from `src/` and commit the generated output so `dist/` matches `src/`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

}
return false;
}
Expand Down Expand Up @@ -409,7 +432,7 @@ async function is_url_safe(url) {
if (!is_proto_safe(schema))
return false;
const parsed = new URL(u);
const hostname = parsed.hostname;
const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
// IPv4 validation
if (/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) {
try {
Expand Down Expand Up @@ -457,7 +480,7 @@ async function is_url_safe_debug(url) { try {
}
console.log("STEP 7 proto safe");
const parsed = new URL(u);
const hostname = parsed.hostname;
const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
console.log("STEP 8 hostname:", hostname);
if (/^\d{1,3}(\.\d{1,3}){3}$/.test(hostname)) {
try {
Expand Down
Loading