Where: internal/config/config.go, parseCIDRList, and internal/httpfetcher/httpfetcher.go, isBlockedIP, on next at 3a6b3bc. Found by the review of #300.
What is wrong: parseCIDRList accepts a blocked_networks entry written in the IPv4-mapped form, such as ::ffff:10.0.0.0/104, but isBlockedIP reads every mapped address as the IPv4 address it holds before matching, so that entry never matches anything. pixa starts without a word and fetches from the range the operator meant to block.
How it fails: an operator writes an IPv4 range in the mapped form in blocked_networks; requests to hosts in that range are fetched.
Severity: medium (a range the operator blocks is silently not blocked).
Definition of done:
A blocked_networks entry in the IPv4-mapped form is either refused at startup with an error naming the setting, or turned into the IPv4 range it covers; README.md says which. Recommended: turn it into the IPv4 range, as the address it holds is how pixa matches.
Test first; make check green.
Package: internal/config (and internal/httpfetcher only if the matching changes).
Model: opus-5-5
Where: `internal/config/config.go`, `parseCIDRList`, and `internal/httpfetcher/httpfetcher.go`, `isBlockedIP`, on `next` at `3a6b3bc`. Found by the review of https://git.eeqj.de/sneak/pixa/pulls/300.
What is wrong: `parseCIDRList` accepts a `blocked_networks` entry written in the IPv4-mapped form, such as `::ffff:10.0.0.0/104`, but `isBlockedIP` reads every mapped address as the IPv4 address it holds before matching, so that entry never matches anything. pixa starts without a word and fetches from the range the operator meant to block.
How it fails: an operator writes an IPv4 range in the mapped form in `blocked_networks`; requests to hosts in that range are fetched.
Severity: medium (a range the operator blocks is silently not blocked).
Definition of done:
1. A `blocked_networks` entry in the IPv4-mapped form is either refused at startup with an error naming the setting, or turned into the IPv4 range it covers; `README.md` says which. Recommended: turn it into the IPv4 range, as the address it holds is how pixa matches.
2. Test first; `make check` green.
Package: `internal/config` (and `internal/httpfetcher` only if the matching changes).
Model: opus-5-5
clawbot
self-assigned this 2026-10-16 06:38:27 +02:00
Plan: build the recommended option, in internal/config only.
parseCIDRList turns a blocked_networks entry written in the IPv4-mapped form, with a prefix of 96 bits or more, into the IPv4 range it covers: ::ffff:10.0.0.0/104 becomes 10.0.0.0/8. Matching in internal/httpfetcher is unchanged, since it already reads a mapped address as the IPv4 address it holds.
A mapped-form entry with a prefix shorter than 96 bits covers more than the IPv4 addresses and is not one IPv4 range; pixa refuses it at startup with an error naming blocked_networks.
README.md, where it describes blocked_networks, says both.
Test first: a new test in internal/config shows the mapped entry blocking an address in the IPv4 range, and fails before the fix. No existing test changes.
Model: opus-5-5
Plan: build the recommended option, in `internal/config` only.
- `parseCIDRList` turns a `blocked_networks` entry written in the IPv4-mapped form, with a prefix of 96 bits or more, into the IPv4 range it covers: `::ffff:10.0.0.0/104` becomes `10.0.0.0/8`. Matching in `internal/httpfetcher` is unchanged, since it already reads a mapped address as the IPv4 address it holds.
- A mapped-form entry with a prefix shorter than 96 bits covers more than the IPv4 addresses and is not one IPv4 range; pixa refuses it at startup with an error naming `blocked_networks`.
- `README.md`, where it describes `blocked_networks`, says both.
Test first: a new test in `internal/config` shows the mapped entry blocking an address in the IPv4 range, and fails before the fix. No existing test changes.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
internal/config/config.go,parseCIDRList, andinternal/httpfetcher/httpfetcher.go,isBlockedIP, onnextat3a6b3bc. Found by the review of #300.What is wrong:
parseCIDRListaccepts ablocked_networksentry written in the IPv4-mapped form, such as::ffff:10.0.0.0/104, butisBlockedIPreads every mapped address as the IPv4 address it holds before matching, so that entry never matches anything. pixa starts without a word and fetches from the range the operator meant to block.How it fails: an operator writes an IPv4 range in the mapped form in
blocked_networks; requests to hosts in that range are fetched.Severity: medium (a range the operator blocks is silently not blocked).
Definition of done:
blocked_networksentry in the IPv4-mapped form is either refused at startup with an error naming the setting, or turned into the IPv4 range it covers;README.mdsays which. Recommended: turn it into the IPv4 range, as the address it holds is how pixa matches.make checkgreen.Package:
internal/config(andinternal/httpfetcheronly if the matching changes).Model: opus-5-5
Plan: build the recommended option, in
internal/configonly.parseCIDRListturns ablocked_networksentry written in the IPv4-mapped form, with a prefix of 96 bits or more, into the IPv4 range it covers:::ffff:10.0.0.0/104becomes10.0.0.0/8. Matching ininternal/httpfetcheris unchanged, since it already reads a mapped address as the IPv4 address it holds.blocked_networks.README.md, where it describesblocked_networks, says both.Test first: a new test in
internal/configshows the mapped entry blocking an address in the IPv4 range, and fails before the fix. No existing test changes.Model: opus-5-5
clawbot referenced this issue2026-10-19 06:12:53 +02:00