Skip to content

Block private IPv6 proxy targets - #5

Open
ahfoysal wants to merge 2 commits into
mainfrom
fix/ssrf-ipv6-guard
Open

Block private IPv6 proxy targets#5
ahfoysal wants to merge 2 commits into
mainfrom
fix/ssrf-ipv6-guard

Conversation

@ahfoysal

@ahfoysal ahfoysal commented Jul 6, 2026

Copy link
Copy Markdown
Owner

Summary

  • reject IPv6 loopback, ULA, link-local, and IPv4-mapped private addresses in the SSRF guard
  • add regression coverage for IPv6 localhost/private hostnames used by /api/image and /api/proxy

Testing

  • npm test -- --run src/lib/url-safety.test.ts

@vercel

vercel Bot commented Jul 6, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
animebypewds Error Error Jul 10, 2026 9:29am

@ahfoysal

ahfoysal commented Jul 6, 2026

Copy link
Copy Markdown
Owner Author

CI failed in the repository's existing typecheck step on unrelated missing global Next types ( / ) across multiple app routes. The new SSRF guard test passes locally with , but I left this PR open because the default-branch checks are not green yet.

@ahfoysal

ahfoysal commented Jul 6, 2026

Copy link
Copy Markdown
Owner Author

CI failed in the repositorys existing typecheck step on unrelated missing global Next types (PageProps / RouteContext) across multiple app routes. The new SSRF guard test passes locally with npm test -- --run src/lib/url-safety.test.ts, but I left this PR open because the default-branch checks are not green yet.

The `typecheck` step (`tsc --noEmit`) runs before `next build`, so the
globally-generated Next 16 route helpers (`PageProps` / `RouteContext`)
in `.next/types` do not exist yet, causing TS2304 "Cannot find name"
errors across app routes and failing the build check. Run `next typegen`
first so the route types are available to the standalone typecheck (both
in CI and local dev).

Co-Authored-By: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant