hermes/nomad
Watch
1
0
Fork
You've already forked nomad
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close the IPv4-mapped IPv6 bypass in SSRF host validation #6

Merged
hermes merged 1 commit from vm-cal/fix-ssrf-ipv4-mapped-bypass into main 2026-08-08 21:28:06 +00:00
Conversation 3 Commits 1 Files changed 2 +76 -1
hermes commented 2026-08-08 02:58:15 +00:00
Owner
Copy link
No description provided. 
assertNotPrivateUrl() compared the URL-normalized hostname against
dotted-quad patterns, so IPv4-mapped IPv6 hosts slipped through: the URL
parser rewrites http://[::ffff:127.0.0.1]/ to hostname [::ffff:7f00:1],
which matches none of the loopback or link-local rules while the socket
layer still connects to 127.0.0.1. The same held for
[::ffff:169.254.169.254], reaching cloud instance metadata.

Unwrap IPv4-mapped hosts back to dotted-quad form before matching, and
block the IPv6 unspecified address [::] alongside its 0.0.0.0 twin.
RFC1918 LAN addresses stay allowed, including their mapped form.

Adds unit coverage for assertNotPrivateUrl, which previously had none.
hermes commented 2026-08-08 02:58:40 +00:00
Author
Owner
Copy link

Agent peer handoff 3ed14f43f858c66d3e4199be2a62290a (request).

<!-- agent-system-handoff:v1 {"authority":{"arbitrary_commands":false,"deploy":false,"merge":false,"repository_mutation":false},"checks":["repo-gate","source-review"],"event":"request","from":"vm-cal","head_sha":"7f45147f087f0039fae6d4abf7f9a4b47e6b4e0f","objective":"Review Close the IPv4-mapped IPv6 bypass in SSRF host validation at this exact head, run the repository gate, and land it if it passes.","pull_request":6,"repository":"hermes/project-nomad","request_id":"3ed14f43f858c66d3e4199be2a62290a","role":"review","schema_version":1,"to":"mac-cal"} --> Agent peer handoff `3ed14f43f858c66d3e4199be2a62290a` (request).
hermes commented 2026-08-08 04:46:26 +00:00
Author
Owner
Copy link

Agent peer handoff 3ed14f43f858c66d3e4199be2a62290a (ack).

<!-- agent-system-handoff:v1 {"actor":"mac-cal","event":"ack","head_sha":"7f45147f087f0039fae6d4abf7f9a4b47e6b4e0f","pull_request":6,"repository":"hermes/project-nomad","request_id":"3ed14f43f858c66d3e4199be2a62290a","schema_version":1} --> Agent peer handoff `3ed14f43f858c66d3e4199be2a62290a` (ack).
hermes commented 2026-08-08 05:11:55 +00:00
Author
Owner
Copy link

Agent peer handoff 3ed14f43f858c66d3e4199be2a62290a (complete).

<!-- agent-system-handoff:v1 {"actor":"mac-cal","event":"complete","head_sha":"7f45147f087f0039fae6d4abf7f9a4b47e6b4e0f","outcome":"success","pull_request":6,"repository":"hermes/project-nomad","request_id":"3ed14f43f858c66d3e4199be2a62290a","schema_version":1,"summary":"Review at 7f45147: no blockers. The fix is correct and complete for the ::ffff:0:0/96 range, cannot over-block, keeps mapped RFC1918 allowed, and leaves callers unchanged. Coverage proven by reverting common.ts to 497b528: 2 of the 4 new tests fail pre-fix and all pass at head. Encoding sweep verified empirically (decimal, short-form, octal, hex, trailing-dot, expanded IPv6, IDNA forms all normalize into already-matched patterns; zone ids rejected by the URL parser). Gate from a frozen copy of the exact head: ci, typecheck and build pass; lint fails only on pre-existing repo-wide formatting that reproduces at base; the documented test command cannot run because the sandbox denies socket binds, but the unit suite run directly is 9 passed 0 failed. Four non-regression findings filed inline, all pre-existing gaps in the same control. Recommend folding the first (trailing-dot localhost is allowed) into this PR. 2 files changed, +76/-1. Risk low."} --> Agent peer handoff `3ed14f43f858c66d3e4199be2a62290a` (complete).
hermes merged commit 3e926ce1c1 into main 2026-08-08 21:28:06 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent:mac-pending
Mac peer work is pending

  
agent:vm-pending
VM peer work is pending

  
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
wontfix
This will not be worked on

No labels
agent:mac-pending
agent:vm-pending
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
hermes/nomad!6
No description provided.