From 2e84faeb28ff8689da212a5b7db805f3b454d4d9 Mon Sep 17 00:00:00 2001 From: James Date: Sun, 26 Jul 2026 18:42:21 +0000 Subject: [PATCH] fix(engine): block future-use IPv4 downloads --- packages/engine/src/utils/urlDownloader.test.ts | 2 ++ packages/engine/src/utils/urlDownloader.ts | 1 + 2 files changed, 3 insertions(+) diff --git a/packages/engine/src/utils/urlDownloader.test.ts b/packages/engine/src/utils/urlDownloader.test.ts index cec00b935..48a18e533 100644 --- a/packages/engine/src/utils/urlDownloader.test.ts +++ b/packages/engine/src/utils/urlDownloader.test.ts @@ -109,6 +109,8 @@ describe("assertPublicHttpsUrl — SSRF guard", () => { "https://198.18.0.1/secret", "https://192.0.2.1/secret", "https://224.0.0.1/secret", + "https://240.0.0.1/secret", + "https://255.255.255.255/secret", ]) { expect(() => assertPublicHttpsUrl(url), url).toThrow("private/reserved"); } diff --git a/packages/engine/src/utils/urlDownloader.ts b/packages/engine/src/utils/urlDownloader.ts index 1853ebf70..8e25966c6 100644 --- a/packages/engine/src/utils/urlDownloader.ts +++ b/packages/engine/src/utils/urlDownloader.ts @@ -114,6 +114,7 @@ for (const [network, prefix] of [ ["198.51.100.0", 24], ["203.0.113.0", 24], ["224.0.0.0", 4], + ["240.0.0.0", 4], ] as const) { NON_PUBLIC_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4"); }