fix(security): block IPv6 unspecified SSRF targets

2026-07-27 10:06:19 +08:00
parent 4408cde019
commit cc3dbbe804
3 changed files with 9 additions and 2 deletions
@@ -20,6 +20,7 @@ _BLOCKED_NETWORKS = [
    ipaddress.ip_network("169.254.0.0/16"),   # link-local / cloud metadata
    ipaddress.ip_network("172.16.0.0/12"),
    ipaddress.ip_network("192.168.0.0/16"),
+    ipaddress.ip_network("::/128"),            # unspecified; may route to local host
    ipaddress.ip_network("::1/128"),
    ipaddress.ip_network("fc00::/7"),          # unique local
    ipaddress.ip_network("fe80::/10"),         # link-local v6