Bjørn Erik Pedersen 24d5e42ffa config/security: Harden the default http.urls and resolved address checks (#15285) ...

The default IP-literal deny rule was case-sensitive, so an uppercase
scheme (e.g. HTTP://127.0.0.1/) slipped past it. Make it case-insensitive
like the other default rules.

CheckAllowedHTTPAddress relied on IsGlobalUnicast/IsPrivate, which admit
CGNAT (100.64.0.0/10), TEST-NET, benchmarking, reserved and IPv6
documentation ranges, and NAT64 addresses embedding an internal IPv4
address. Deny those explicitly and unwrap NAT64 before classifying.

Thanks to @0xdeadbab3 for finding and reporting this issue.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-03 13:29:38 +02:00

..

articles.toml

Merge commit '9b0050e9aabe4be65c78ccf292a348f309d50ccd' as 'docs'

2024-01-27 10:48:57 +01:00

docs.yaml

config/security: Harden the default http.urls and resolved address checks (#15285)

2026-09-03 13:29:38 +02:00

embedded_template_urls.toml

Merge commit 'b3d87dd0fd746f07f9afa6e6a2969aea41da6a38'

2025-04-24 10:23:16 +02:00

homepagetweets.toml

Merge commit '8b9803425e63e1b1801f8d5d676e96368d706722'

2024-06-21 09:41:24 +02:00

keywords.yaml

Merge commit '8f3c066d23f431fb2c53d97ea489e4c28b42bd82'

2026-02-14 12:14:33 +01:00

page_filters.yaml

Merge commit 'e7afabb927a79b179ae57013fd5f49e32829671e'

2026-03-23 18:25:55 +01:00

sponsors.toml

Merge commit '8f3c066d23f431fb2c53d97ea489e4c28b42bd82'

2026-02-14 12:14:33 +01:00