Where: internal/config/config.go, parseCIDRList, and internal/httpfetcher/httpfetcher.go, isBlockedIP, on next at 3a6b3bc. Found by the review of #300.
What is wrong: parseCIDRList accepts a blocked_networks entry written in the IPv4-mapped form, such as ::ffff:10.0.0.0/104, but isBlockedIP reads every mapped address as the IPv4 address it holds before matching, so that entry never matches anything. pixa starts without a word and fetches from the range the operator meant to block.
How it fails: an operator writes an IPv4 range in the mapped form in blocked_networks; requests to hosts in that range are fetched.
Severity: medium (a range the operator blocks is silently not blocked).
Definition of done:
A blocked_networks entry in the IPv4-mapped form is either refused at startup with an error naming the setting, or turned into the IPv4 range it covers; README.md says which. Recommended: turn it into the IPv4 range, as the address it holds is how pixa matches.
Test first; make check green.
Package: internal/config (and internal/httpfetcher only if the matching changes).
Model: opus-5-5
Where: `internal/config/config.go`, `parseCIDRList`, and `internal/httpfetcher/httpfetcher.go`, `isBlockedIP`, on `next` at `3a6b3bc`. Found by the review of https://git.eeqj.de/sneak/pixa/pulls/300.
What is wrong: `parseCIDRList` accepts a `blocked_networks` entry written in the IPv4-mapped form, such as `::ffff:10.0.0.0/104`, but `isBlockedIP` reads every mapped address as the IPv4 address it holds before matching, so that entry never matches anything. pixa starts without a word and fetches from the range the operator meant to block.
How it fails: an operator writes an IPv4 range in the mapped form in `blocked_networks`; requests to hosts in that range are fetched.
Severity: medium (a range the operator blocks is silently not blocked).
Definition of done:
1. A `blocked_networks` entry in the IPv4-mapped form is either refused at startup with an error naming the setting, or turned into the IPv4 range it covers; `README.md` says which. Recommended: turn it into the IPv4 range, as the address it holds is how pixa matches.
2. Test first; `make check` green.
Package: `internal/config` (and `internal/httpfetcher` only if the matching changes).
Model: opus-5-5
clawbot
self-assigned this 2026-10-16 06:38:27 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
internal/config/config.go,parseCIDRList, andinternal/httpfetcher/httpfetcher.go,isBlockedIP, onnextat3a6b3bc. Found by the review of #300.What is wrong:
parseCIDRListaccepts ablocked_networksentry written in the IPv4-mapped form, such as::ffff:10.0.0.0/104, butisBlockedIPreads every mapped address as the IPv4 address it holds before matching, so that entry never matches anything. pixa starts without a word and fetches from the range the operator meant to block.How it fails: an operator writes an IPv4 range in the mapped form in
blocked_networks; requests to hosts in that range are fetched.Severity: medium (a range the operator blocks is silently not blocked).
Definition of done:
blocked_networksentry in the IPv4-mapped form is either refused at startup with an error naming the setting, or turned into the IPv4 range it covers;README.mdsays which. Recommended: turn it into the IPv4 range, as the address it holds is how pixa matches.make checkgreen.Package:
internal/config(andinternal/httpfetcheronly if the matching changes).Model: opus-5-5