fix: use the correct RFC 6052 layout for NAT64 /48 local-use addresses

The NAT64 match covered all of 64:ff9b::/32 but always read the embedded IPv4
from the low 32 bits. That is the layout for the well-known 64:ff9b::/96 prefix
only. For the RFC 8215 local-use prefix 64:ff9b:1::/48, RFC 6052 places the IPv4
in bytes 6-7 and 9-10 (byte 8 is the reserved u-octet).

Reading the low bits for a /48 address is wrong in both directions: a /48 address
embedding an internal destination while carrying a routable value in its low 32
bits was read as routable and allowed through, and a /48 address embedding a
routable destination whose low bits are zero was misread as 0.0.0.0 and blocked.

Split the match into the well-known /96 (which now also requires bytes 4-11 to be
zero) and the local-use /48, and reassemble the /48 IPv4 from its correct bytes.
Other RFC 6052 prefix lengths use a Network-Specific Prefix that cannot be
recognized from the address alone and remain out of scope, as noted.

Tests confirmed red against the pre-fix source (2 bypass cases, 1 over-block).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: wyattwalter

app/server/appsmith-interfaces/src/main/java/com/appsmith/util/RestrictedHostFilter.java

@@ -803,16 +803,26 @@ private static InetAddress parseIpLiteral(String host) throws UnknownHostExcepti
      * none. Covers the embeddings where the IPv6 address is purely an encoding of an IPv4 one, so
      * collapsing to that IPv4 is a faithful canonical form: IPv4-compatible ({@code ::d.d.d.d}),
      * IPv4-mapped ({@code ::ffff:d.d.d.d}), IPv4-translated ({@code ::ffff:0:d.d.d.d}, RFC 2765),
-     * NAT64 (RFC 6052 well-known {@code 64:ff9b::/96} and RFC 8215 local-use {@code 64:ff9b:1::/48}),
-     * and 6to4 (RFC 3056 {@code 2002::/16}).
+     * NAT64 — the RFC 6052 well-known {@code 64:ff9b::/96} (low 32 bits) and the RFC 8215 local-use
+     * {@code 64:ff9b:1::/48} (RFC 6052 /48 layout: bytes 6-7 and 9-10) — and 6to4 (RFC 3056
+     * {@code 2002::/16}).
      */
     private static byte[] extractEmbeddedIpv4(byte[] addressBytes) {
         if (addressBytes.length != 16) {
             return null;
         }
-        if (isIpv4CompatibleOrMapped(addressBytes) || isIpv4Translated(addressBytes) || isNat64(addressBytes)) {
+        if (isIpv4CompatibleOrMapped(addressBytes)
+                || isIpv4Translated(addressBytes)
+                || isNat64WellKnown(addressBytes)) {
             return Arrays.copyOfRange(addressBytes, 12, 16);
         }
+        if (isNat64LocalUse(addressBytes)) {
+            // RFC 6052 /48 layout: the 32-bit IPv4 is split across bytes 6-7 and 9-10; byte 8 is
+            // the reserved u-octet and is skipped. Reading the low 32 bits here (bytes 12-15) would
+            // misread the address — letting a /48-embedded internal destination through when its
+            // suffix looks routable, and over-blocking a /48-embedded routable one whose suffix is 0.
+            return new byte[] {addressBytes[6], addressBytes[7], addressBytes[9], addressBytes[10]};
+        }
         if (isSixToFour(addressBytes)) {
             return Arrays.copyOfRange(addressBytes, 2, 6);
         }
@@ -851,12 +861,40 @@ private static List<byte[]> embeddedIpv4Candidates(byte[] addressBytes) {
         return List.of();
     }
 
-    /** {@code 64:ff9b::/32} — spans the RFC 6052 well-known and RFC 8215 local-use NAT64 prefixes. */
-    private static boolean isNat64(byte[] addressBytes) {
+    /**
+     * {@code 64:ff9b::/96} — the RFC 6052 well-known NAT64 prefix. Mandated to use the /96 layout,
+     * so the embedded IPv4 is the low 32 bits (bytes 12-15). Requires bytes 4-11 to be zero;
+     * without that, a {@code 64:ff9b:1::/48} local-use address would also match and be misread.
+     */
+    private static boolean isNat64WellKnown(byte[] addressBytes) {
+        if (addressBytes[0] != 0x00
+                || addressBytes[1] != 0x64
+                || addressBytes[2] != (byte) 0xff
+                || addressBytes[3] != (byte) 0x9b) {
+            return false;
+        }
+        for (int i = 4; i < 12; i++) {
+            if (addressBytes[i] != 0) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * {@code 64:ff9b:1::/48} — the RFC 8215 local-use NAT64 prefix. Per RFC 6052 the /48 layout
+     * embeds the IPv4 across bytes 6-7 and 9-10 (byte 8 is the reserved u-octet), which
+     * {@link #extractEmbeddedIpv4(byte[])} reassembles. Other RFC 6052 prefix lengths use a
+     * Network-Specific Prefix that cannot be recognized from the address alone, so — like 6rd —
+     * they are out of scope.
+     */
+    private static boolean isNat64LocalUse(byte[] addressBytes) {
         return addressBytes[0] == 0x00
                 && addressBytes[1] == 0x64
                 && addressBytes[2] == (byte) 0xff
-                && addressBytes[3] == (byte) 0x9b;
+                && addressBytes[3] == (byte) 0x9b
+                && addressBytes[4] == 0x00
+                && addressBytes[5] == 0x01;
     }
 
     /** {@code 2002::/16} — 6to4 carries its IPv4 in bytes 2-5 rather than the low 32 bits. */

app/server/appsmith-interfaces/src/test/java/com/appsmith/util/RestrictedHostFilterTest.java

@@ -215,9 +215,16 @@ public void isBlockedIpAddressClass_recognizesZeroPaddedNonRoutableLiterals(Stri
                 "64:ff9b::7f00:1", // 127.0.0.1
                 "64:ff9b::a9fe:a9fe", // 169.254.169.254
                 "64:ff9b::e000:1", // 224.0.0.1
-                // NAT64 local-use prefix (RFC 8215)
-                "64:ff9b:1::7f00:1", // 127.0.0.1
-                "64:ff9b:1::a9fe:a9fe", // 169.254.169.254
+                // NAT64 local-use prefix (RFC 8215, 64:ff9b:1::/48). Per RFC 6052 the embedded
+                // IPv4 lives in bytes 6-7 and 9-10 (byte 8 is the reserved u-octet), NOT the low
+                // 32 bits. The first two have zero in those positions, so they embed 0.0.0.0
+                // (any-local) and block on that; the next two embed a non-routable address in the
+                // correct /48 position while carrying a *routable* suffix in the low 32 bits —
+                // reading the low bits (the old behavior) would let these through.
+                "64:ff9b:1::7f00:1", // /48 positions zero -> 0.0.0.0
+                "64:ff9b:1::a9fe:a9fe", // /48 positions zero -> 0.0.0.0
+                "64:ff9b:1:7f00:0:100:808:808", // /48 embeds 127.0.0.1; low bits 8.8.8.8
+                "64:ff9b:1:a9fe:a9:fe00:808:808", // /48 embeds 169.254.169.254; low bits 8.8.8.8
                 // 6to4 (RFC 3056) — embedded IPv4 sits in bytes 2-5
                 "2002:7f00:1::", // 127.0.0.1
                 "2002:a9fe:a9fe::", // 169.254.169.254
@@ -257,6 +264,10 @@ public void isBlockedIpAddressClass_recognizesIpv6TransitionEmbeddedNonRoutable(
                 // IPv6-only network this is how legitimate IPv4 destinations are addressed.
                 "2002:0808:0808::",
                 "64:ff9b::808:808",
+                // NAT64 /48 local-use embedding a routable public IPv4 (8.8.8.8) in the correct
+                // RFC 6052 /48 position. Reading the low 32 bits (the old behavior) saw 0.0.0.0
+                // and over-blocked this legitimate destination.
+                "64:ff9b:1:808:8:800::",
             })
     public void isBlockedIpAddressClass_stillAllowsRoutableNonCanonicalLiterals(String host) {
         assertFalse(