Security review of #106 surfaced two HIGH-severity gaps in the SSRF
guard. Both are documented bypass classes with public CVE precedent
(github.com/projectdiscovery/nuclei-templates' SSRF templates list
hex and IPv4-mapped IPv6 explicitly).
- Hex-notation IPv4: 'http://0x7f.0.0.1' / 'http://0x7f000001' /
'http://0xa.0.0.1' all parse to internal addresses depending on
the runtime's URL semantics. Reject the raw form before parsing.
- Decimal-notation IPv4: 'http://2130706433' is 127.0.0.1, etc.
Reject any pure-numeric host of plausible IP length.
- IPv4-mapped IPv6: '[::ffff:127.0.0.1]' and the hex variant
'[::ffff:7f00:1]' both target loopback. Match either form and
apply the private-IPv4 check to the embedded address.
- '[::]' (IPv6 unspecified, alias for 0.0.0.0) blocked alongside
'[::1]'.
Refactored the per-octet private-range checks into isPrivateIpv4()
since both the IPv4 and the IPv4-mapped-IPv6 paths now use them.
Test suite extended with regression cases for hex, decimal, and
IPv4-mapped IPv6. Now 208/208 passing.
- New unit tests for isPublicUrl covering loopback, link-local, RFC1918,
CGNAT, IPv6 ranges, and the leading-zero IPv4 octal-bypass regression
(URL parser silently turns '010.0.0.1' into '8.0.0.1' — caught now).
- Strengthened isPublicUrl: pre-URL leading-zero check on the raw input,
bracket-aware IPv6, deny on malformed IPv4 quads instead of falling
through to 'public' (better safe than sorry on user-supplied URLs).
- New unit tests for measurement validation covering the new
TOTAL_BODY_WATER and BONE_MASS types: ranges, glucoseContext rejection
on non-glucose types, and unrecognised type rejection.
Marc-André Bombeck