clawbot faad959bea Refuse local-use NAT64 addresses, and IPv4-compatible ones in blocked_networks (closes #299) ...

The check that keeps pixa from fetching internal addresses let through
64:ff9b:1::/48, the local-use NAT64 range, and matched an address in the
IPv4-compatible form (::/96) against blocked_networks only as IPv6, so
::203.0.113.5 passed with 203.0.113.0/24 listed. The local-use NAT64
range is now blocked next to 64:ff9b::/96, and an address in ::/96 is
refused when blocked_networks holds it as written or the IPv4 address it
holds. The mapped form stays matched as IPv4 only, as Go keeps plain
IPv4 addresses in that form; README.md says so.

Model: opus-5-5

2026-10-16 06:52:17 +02:00

..

blocked_networks_internal_test.go

feat: blocked_networks config and extended SSRF ranges (closes #67)

2026-09-22 00:43:27 +02:00

dial_context_internal_test.go

Test the image proxy flow end to end (closes #80)

2026-10-04 23:24:46 +02:00

fetch_internal_test.go

Accept a chunked upstream body of exactly the maximum size (closes #248)

2026-10-15 07:44:09 +02:00

httpfetcher_internal_test.go

Refuse an IPv6 address that holds an internal IPv4 address (closes #297)

2026-10-16 05:31:55 +02:00

httpfetcher.go

Refuse local-use NAT64 addresses, and IPv4-compatible ones in blocked_networks (closes #299)

2026-10-16 06:52:17 +02:00

jpegxl_internal_test.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

max_connections_internal_test.go

Remove idle host semaphores and delete .meta with its variant (closes #87)

2026-10-04 07:11:31 +02:00

mock.go

Serve and accept JPEG XL as an image format (part of #222)

2026-10-08 11:01:12 +02:00

request_id_internal_test.go

Return and pass on request IDs, and give /v1/e/ ETag, 304 and HEAD (closes #84)

2026-10-04 12:41:54 +02:00