Linus Rath 5d017fd2b1 fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard ...

The URL guard behind fetch-ical, OAuth discovery, branding and the
server-side JMAP fetches blocked only the single address 127.0.0.1 plus
the RFC 1918, link-local and ULA subnets. Any logged-in user could make
the server fetch 127.0.0.2, 100.64.0.0/10, 198.18.0.0/15, multicast,
reserved space or a NAT64/6to4/Teredo address that wraps an internal
IPv4 address.

The telemetry guard already rejected all of these (GHSA-m7j8), so its
range check moves to `lib/security/ip-ranges.ts` and both guards use it.
`guardedLookup` inherits the wider list, so the connect-time rebinding
check covers the new ranges too.

2026-09-26 14:00:01 +02:00

..

app-frame-origins-client.ts

fix: add embedded custom app origins to CSP frame-src #787

2026-08-16 23:48:58 +02:00

app-frame-origins.ts

fix: add embedded custom app origins to CSP frame-src #787

2026-08-16 23:48:58 +02:00

ip-ranges.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00

same-origin.ts

fix: reject cross-site requests to /api/auth/* to stop session fixation (GHSA-qvr9-m8cq-7wvg)

2026-09-17 20:01:35 +02:00

url-guard.ts

fix: block loopback, CGNAT and IPv6 transition ranges in the SSRF guard

2026-09-26 14:00:01 +02:00