From 78c6751fa048e8a1c47efaa5cca26a78812e06dc Mon Sep 17 00:00:00 2001 From: "Stanko K.R." Date: Tue, 2 Dec 2025 09:32:15 +0100 Subject: [PATCH] Prohibit link local addresses --- app/models/webhook/delivery.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/app/models/webhook/delivery.rb b/app/models/webhook/delivery.rb index 05768e04a..ce69c01ad 100644 --- a/app/models/webhook/delivery.rb +++ b/app/models/webhook/delivery.rb @@ -4,8 +4,6 @@ class Webhook::Delivery < ApplicationRecord ENDPOINT_TIMEOUT = 7.seconds DNS_RESOLUTION_TIMEOUT = 2 DISALLOWED_IP_RANGES = [ - # IPv4 mapped to IPv6 - IPAddr.new("::ffff:0:0/96"), # Broadcasts IPAddr.new("0.0.0.0/8") ].freeze @@ -85,7 +83,7 @@ class Webhook::Delivery < ApplicationRecord end ip_addresses.any? do |ip| - ip.private? || ip.loopback? || DISALLOWED_IP_RANGES.any? { |range| range.include?(ip) } + ip.private? || ip.loopback? || ip.link_local? || ip.ipv4_mapped? || DISALLOWED_IP_RANGES.any? { |range| range.include?(ip) } end end