ico/pingql
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: harden auth, SSRF, query engine, and cookie security

Browse Source
This commit is contained in:
nate
2026-03-18 11:37:33 +04:00
parent d278ab0458
commit 5a0cf5033b
14 changed files with 212 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/utils/ssrf.ts
+14 -7
View File
@@ -21,14 +21,21 @@ function isPrivateIP(ip: string): boolean {
if (second >= 16 && second <= 31) return true;
}
// IPv6
if (ip === "::1" || ip === "::") return true;
if (ip.toLowerCase().startsWith("fe80")) return true; // fe80::/10
if (ip.toLowerCase().startsWith("fd00:ec2::254")) return true; // AWS EC2 metadata
if (ip.toLowerCase() === "::ffff:127.0.0.1") return true;
if (ip.toLowerCase().startsWith("::ffff:")) {
// IPv6 — normalize: strip zone ID (%eth0) and lowercase
const ip6 = ip.replace(/%.*$/, "").toLowerCase();
if (ip6 === "::1" || ip6 === "::") return true;
if (ip6.startsWith("fe80")) return true; // fe80::/10 link-local
if (ip6.startsWith("fc") || ip6.startsWith("fd")) return true; // fc00::/7 unique-local (ULA)
if (ip6.startsWith("fd00:ec2::")) return true; // AWS EC2 metadata IPv6
if (ip6 === "::ffff:127.0.0.1") return true;
if (ip6.startsWith("::ffff:")) {
// IPv4-mapped IPv6 — extract the IPv4 part and re-check
const v4 = ip.slice(7);
const v4 = ip6.slice(7);
return isPrivateIP(v4);
}
// IPv4-compatible IPv6 (deprecated but still reachable)
if (ip6.startsWith("::") && ip6.includes(".")) {
const v4 = ip6.slice(2);
return isPrivateIP(v4);
}