fix(engine): block future-use IPv4 downloads

2026-09-04 16:42:27 +00:00 · 2026-07-26 19:00:41 +00:00
parent 4b81f78586
commit 2e84faeb28
2 changed files with 3 additions and 0 deletions
@@ -109,6 +109,8 @@ describe("assertPublicHttpsUrl — SSRF guard", () => {
      "https://198.18.0.1/secret",
      "https://192.0.2.1/secret",
      "https://224.0.0.1/secret",
+      "https://240.0.0.1/secret",
+      "https://255.255.255.255/secret",
    ]) {
      expect(() => assertPublicHttpsUrl(url), url).toThrow("private/reserved");
    }