mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 21:10:59 +00:00
Marc-André BombeckandClaude Opus 4.7
a4e4aaf009
`/api/send` is the public Umami proxy. The hand-rolled allowlist it carried predated the central `isPublicUrl` helper in `src/lib/validations/notifications.ts` and was missing every notation-bypass class the helper catches: - 100.64.0.0/10 CGNAT - 0.0.0.0/8 (only the literal `0.0.0.0` was matched) - 169.254/16 outside the AWS metadata IP (e.g. azure metadata is `169.254.169.254` too, but other addresses in the block are routable to other internal endpoints) - IPv6 ULA (`fc00::/7`) - IPv4-mapped IPv6 (`::ffff:127.0.0.1`) - Leading-zero IPv4 octal bypass (`http://010.0.0.1` → 8.0.0.1) - Hex IPv4 (`http://0x7f.0.0.1`) - Pure-decimal IPv4 (`http://2130706433`) The dev-mode escape hatch is also dropped — serving the proxy against a localhost / RFC1918 Umami target was never a useful configuration anyway, since the proxy sends the visitor's user-agent + body upstream which only makes sense against an externally-reachable analytics host. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>