ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-09-03 04:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(engine): block future-use IPv4 downloads

Browse Source
This commit is contained in:
James
2026-07-26 19:00:41 +00:00
parent 4b81f78586
commit 2e84faeb28
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/engine/src/utils/urlDownloader.test.ts
+2
View File
@@ -109,6 +109,8 @@ describe("assertPublicHttpsUrl — SSRF guard", () => {
"https://198.18.0.1/secret", "https://198.18.0.1/secret",
"https://192.0.2.1/secret", "https://192.0.2.1/secret",
"https://224.0.0.1/secret", "https://224.0.0.1/secret",
"https://240.0.0.1/secret",
"https://255.255.255.255/secret",
]) { ]) {
expect(() => assertPublicHttpsUrl(url), url).toThrow("private/reserved"); expect(() => assertPublicHttpsUrl(url), url).toThrow("private/reserved");
} }
packages/engine/src/utils/urlDownloader.ts
+1
View File
@@ -114,6 +114,7 @@ for (const [network, prefix] of [
["198.51.100.0", 24], ["198.51.100.0", 24],
["203.0.113.0", 24], ["203.0.113.0", 24],
["224.0.0.0", 4], ["224.0.0.0", 4],
["240.0.0.0", 4],
] as const) { ] as const) {
NON_PUBLIC_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4"); NON_PUBLIC_IPV4_ADDRESSES.addSubnet(network, prefix, "ipv4");
} }