peach-browser / 7cf0e6d4b0c4

fix: canary webhook filter rejects IPv4-mapped IPv6 private literals (v4.8.4) Codex Security 2026-08-04 LOW (ssrf.webhook-url-private-ip-filter, CWE-918): isPrivateIpv6 matched only ::1/fc*/fd*/fe80:*, so IPv4-mapped IPv6 literals (WHATWG URL serializes [::ffff:192.168.0.1] as ::ffff:c0a8:1) sailed through isAllowedCanaryWebhookUrl and were fetched by FIRE_CANARY_PING — a blind SSRF onto the user's LAN (requires a prior write primitive to plant the URL). Fix: isPrivateIpv6 unwraps ::ffff:xxyy:zzww (and dotted) mapped forms and runs the embedded IPv4 through isPrivateIpv4; unparseable mapped tails fail closed. DNS rebinding remains out of scope for a one-shot host check. Test: six mapped-private literals rejected, no fetch issued.

dev · 3 weeks ago · 2026-08-04 · 5.8 MB

parent: 2945bb7a571a