mirror of
https://github.com/gohugoio/hugo.git
synced 2026-09-03 20:22:38 +00:00
Bjørn Erik Pedersen
24d5e42ffa
The default IP-literal deny rule was case-sensitive, so an uppercase scheme (e.g. HTTP://127.0.0.1/) slipped past it. Make it case-insensitive like the other default rules. CheckAllowedHTTPAddress relied on IsGlobalUnicast/IsPrivate, which admit CGNAT (100.64.0.0/10), TEST-NET, benchmarking, reserved and IPv6 documentation ranges, and NAT64 addresses embedding an internal IPv4 address. Deny those explicitly and unwrap NAT64 before classifying. Thanks to @0xdeadbab3 for finding and reporting this issue. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
