Merge branch 'main' into fix/accept-weight-trailing-whitespace

gaby · web-flow · commit 9db7ad172a01 · 2026-07-22T22:32:00.000-04:00
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
diff --git a/.github/workflows/deadcode.yml b/.github/workflows/deadcode.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
diff --git a/.github/workflows/manual-dependabot.yml b/.github/workflows/manual-dependabot.yml
@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout dependabot
         run: |
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Fetch Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run markdownlint-cli2
         uses: DavidAnson/markdownlint-cli2-action@6bf21b07787794f89a243495939cd651942aeabe # v24.1.0
diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Fetch Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -56,7 +56,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Fetch Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # PAT with bypass rights for the protected `main` branch.
           # The default GITHUB_TOKEN cannot push directly to `main`.
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
@@ -26,7 +26,7 @@ jobs:
       GO111MODULE: on
     steps:
       - name: Fetch Repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
diff --git a/go.mod b/go.mod
@@ -4,7 +4,7 @@ go 1.25.0
 
 require (
 	github.com/gofiber/schema v1.8.3
-	github.com/gofiber/utils/v2 v2.2.0
+	github.com/gofiber/utils/v2 v2.3.0
 	github.com/google/uuid v1.6.0
 	github.com/mattn/go-colorable v0.1.15
 	github.com/mattn/go-isatty v0.0.23
diff --git a/go.sum b/go.sum
@@ -6,8 +6,8 @@ github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh
 github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
 github.com/gofiber/schema v1.8.3 h1:06ZedxIYjngzc0095PYy7uWnFnbRflWFpikvZH61fDc=
 github.com/gofiber/schema v1.8.3/go.mod h1:jWnnZdhcW1mHyV+VnfRxKJDPNcepJsTZ9RIWxrr32Ng=
-github.com/gofiber/utils/v2 v2.2.0 h1:YSSmCzQponq/f9uSOg2HtXC5qK1Dmor0o6DqaQVz8GE=
-github.com/gofiber/utils/v2 v2.2.0/go.mod h1:Ieopk6sQh7rbhQ12aBNCJtJuG0gxAg0nz63sFCrrOmE=
+github.com/gofiber/utils/v2 v2.3.0 h1:+bjMBw2CXwjAYZO9F04Hnfz7UR03TkupQB8W5h6dvwo=
+github.com/gofiber/utils/v2 v2.3.0/go.mod h1:I+RTsgMUdzFuifVc3LOEkfh32wQW9BfRl7l5RYjamW4=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
diff --git a/middleware/proxy/security.go b/middleware/proxy/security.go
@@ -601,9 +601,16 @@ func newGuardedClientDialerWithTimeout(orig fasthttp.DialFuncWithTimeout, dialDu
 // isBlockedIP reports whether ip falls inside a range that proxy
 // upstreams must not reach by default. Loopback, unspecified, RFC 1918
 // private, link-local (including the 169.254.169.254 cloud-metadata
-// address), multicast, and RFC 6598 CGNAT ranges are blocked. IPv4-compatible
-// and NAT64 IPv6 wrappers are unwrapped so a blocked IPv4 cannot be smuggled
-// past as an IPv6 literal.
+// address), multicast, and RFC 6598 CGNAT ranges are blocked.
+//
+// IPv6 transition addresses are handled in two ways so a blocked IPv4 cannot
+// be smuggled past as an IPv6 literal. Deprecated tunneling and local-use
+// ranges (6to4, Teredo, NAT64 local-use) are blocked in their entirety by
+// isBlockedIPv6TransitionRange — their embedded IPv4 sits at an
+// operator-dependent offset, and none has a legitimate use as a proxy
+// upstream. The remaining wrappers whose embedded IPv4 is unambiguous and may
+// legitimately be public (NAT64 well-known prefix, IPv4-compatible, ISATAP)
+// are unwrapped by embeddedIPv4 and re-checked against the same blocklist.
 func isBlockedIP(ip net.IP) bool {
 	if ip == nil {
 		return true
@@ -616,32 +623,100 @@ func isBlockedIP(ip net.IP) bool {
 	if v4 := ip.To4(); v4 != nil && v4[0] == 100 && v4[1] >= 64 && v4[1] <= 127 {
 		return true
 	}
-	// Look through IPv4-compatible (::a.b.c.d) and NAT64 (64:ff9b::a.b.c.d)
-	// IPv6 wrappers to the embedded IPv4 and apply the same blocklist. Some
-	// stacks route these to the embedded address, so a private target could
-	// otherwise be reached via such a literal (the IPv4-mapped ::ffff:a.b.c.d
-	// form is already handled above because net.IP.To4 exposes it).
+	// Block deprecated / local-use IPv6 transition ranges wholesale (see the
+	// helper for the rationale). Done before the embeddedIPv4 unwrap because
+	// their embedded IPv4 offset is not fixed.
+	if isBlockedIPv6TransitionRange(ip) {
+		return true
+	}
+	// Look through the unambiguous wrappers to the embedded IPv4 and apply the
+	// same blocklist. Some stacks route these to the embedded address, so a
+	// private target could otherwise be reached via such a literal (the
+	// IPv4-mapped ::ffff:a.b.c.d form is already handled above because
+	// net.IP.To4 exposes it).
 	if embedded := embeddedIPv4(ip); embedded != nil && isBlockedIP(embedded) {
 		return true
 	}
 	return false
 }
 
-// embeddedIPv4 returns the IPv4 address embedded in an IPv4-compatible IPv6
-// address (::a.b.c.d, RFC 4291) or a well-known-prefix NAT64 address
-// (64:ff9b::a.b.c.d, RFC 6052), or nil for anything else. The IPv4-mapped
-// form (::ffff:a.b.c.d) is deliberately excluded here: net.IP.To4 already
-// surfaces its IPv4, so isBlockedIP checks it directly.
+// isBlockedIPv6TransitionRange reports whether ip belongs to an IPv6
+// transition range that must be blocked in its entirety:
+//
+//   - 6to4         2002::/16        (RFC 3056) — deprecated by RFC 7526.
+//   - Teredo       2001:0000::/32   (RFC 4380) — a private IPv4 can hide in
+//     either the un-obfuscated server field (bytes [4:8]) or the obfuscated
+//     client field (bytes [12:16]).
+//   - NAT64 local  64:ff9b:1::/48   (RFC 8215) — local-use only; RFC 8215 §3
+//     forbids it on the public Internet, and RFC 6052 lets the embedded IPv4
+//     sit anywhere from a /32 to a /96 boundary.
+//
+// Because the embedded IPv4 offset depends on operator configuration,
+// unwrapping a single position would leave a bypass; blocking the whole range
+// is both safer and simpler. This mirrors the CIDR-level handling in Gitea's
+// and Coder's SSRF guards.
+func isBlockedIPv6TransitionRange(ip net.IP) bool {
+	ip16 := ip.To16()
+	if ip16 == nil || ip.To4() != nil {
+		return false
+	}
+	switch {
+	case ip16[0] == 0x20 && ip16[1] == 0x02: // 6to4 2002::/16
+		return true
+	case ip16[0] == 0x20 && ip16[1] == 0x01 && ip16[2] == 0x00 && ip16[3] == 0x00: // Teredo 2001:0000::/32
+		return true
+	case ip16[0] == 0x00 && ip16[1] == 0x64 && ip16[2] == 0xff && ip16[3] == 0x9b &&
+		ip16[4] == 0x00 && ip16[5] == 0x01: // NAT64 local-use 64:ff9b:1::/48
+		return true
+	}
+	return false
+}
+
+// embeddedIPv4 returns the IPv4 address embedded in an IPv6 transition
+// address, or nil for anything else. It only handles wrappers whose embedded
+// IPv4 has a fixed, unambiguous offset and can legitimately be a public host:
+//
+//   - NAT64 well-known prefix 64:ff9b::/96 (RFC 6052) — defined only at /96,
+//     so the embedded IPv4 is always the trailing 32 bits and is commonly used
+//     to reach public IPv4 hosts from IPv6-only networks.
+//   - ISATAP (RFC 5214) — interface identifier 00-00-5E-FE or 02-00-5E-FE
+//     followed by the embedded IPv4 in the trailing 32 bits. The prefix is an
+//     ordinary global one, so there is no dedicated range to block wholesale.
+//   - SIIT IPv4-translated ::ffff:0:0/96 (RFC 2765) — 0xffff marker in bytes
+//     [8:10], zero in [10:12], embedded IPv4 in the trailing 32 bits.
+//   - IPv4-compatible ::a.b.c.d (RFC 4291) — trailing 32 bits.
+//
+// Deprecated tunneling / local-use ranges with operator-dependent embedding
+// offsets (6to4, Teredo, NAT64 local-use) are intentionally NOT unwrapped here;
+// isBlockedIPv6TransitionRange blocks them wholesale instead. The IPv4-mapped
+// form (::ffff:a.b.c.d, 0xffff marker in bytes [10:12]) is also excluded:
+// net.IP.To4 already surfaces its IPv4, so isBlockedIP checks it directly.
 func embeddedIPv4(ip net.IP) net.IP {
 	ip16 := ip.To16()
 	if ip16 == nil || ip.To4() != nil {
 		return nil
 	}
-	// NAT64 well-known prefix 64:ff9b::/96.
+	// NAT64 well-known prefix 64:ff9b::/96 (RFC 6052).
 	if ip16[0] == 0x00 && ip16[1] == 0x64 && ip16[2] == 0xff && ip16[3] == 0x9b &&
 		allZero(ip16[4:12]) {
 		return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15])
 	}
+	// ISATAP (RFC 5214): interface identifier ::0:5efe:a.b.c.d or
+	// ::200:5efe:a.b.c.d — the 5e:fe marker (with the IANA OUI and the
+	// universal/local bit in ip16[8]) precedes the embedded IPv4.
+	if ip16[9] == 0x00 && ip16[10] == 0x5e && ip16[11] == 0xfe &&
+		(ip16[8] == 0x00 || ip16[8] == 0x02) {
+		return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15])
+	}
+	// SIIT IPv4-translated ::ffff:0:a.b.c.d (RFC 2765, prefix ::ffff:0:0/96):
+	// the 0xffff marker sits in bytes [8:10] with [10:12] zero, and the
+	// embedded IPv4 is the trailing 32 bits. This is distinct from the
+	// IPv4-mapped form (::ffff:a.b.c.d, marker in bytes [10:12]) that
+	// net.IP.To4 already exposes, so it is unwrapped here.
+	if allZero(ip16[:8]) && ip16[8] == 0xff && ip16[9] == 0xff &&
+		ip16[10] == 0x00 && ip16[11] == 0x00 {
+		return net.IPv4(ip16[12], ip16[13], ip16[14], ip16[15])
+	}
 	// IPv4-compatible ::a.b.c.d (first 12 bytes zero). :: and ::1 have already
 	// been classified above, so treat any remaining all-zero-prefix address as
 	// a wrapper around its trailing IPv4.
diff --git a/middleware/proxy/security_test.go b/middleware/proxy/security_test.go
@@ -31,27 +31,45 @@ func Test_Security_IsBlockedIP(t *testing.T) {
 	t.Parallel()
 
 	cases := map[string]bool{
-		"127.0.0.1":            true,
-		"::1":                  true,
-		"0.0.0.0":              true,
-		"10.0.0.1":             true,
-		"172.16.0.1":           true,
-		"192.168.1.1":          true,
-		"169.254.169.254":      true, // AWS metadata
-		"100.64.0.1":           true, // CGNAT
-		"224.0.0.1":            true, // multicast
-		"::ffff:127.0.0.1":     true, // IPv4-mapped loopback
-		"::ffff:10.0.0.1":      true, // IPv4-mapped private
-		"::127.0.0.1":          true, // IPv4-compatible loopback
-		"::10.0.0.1":           true, // IPv4-compatible private
-		"64:ff9b::7f00:1":      true, // NAT64 127.0.0.1
-		"64:ff9b::a00:1":       true, // NAT64 10.0.0.1
-		"64:ff9b::a9fe:a9fe":   true, // NAT64 169.254.169.254 (metadata)
-		"8.8.8.8":              false,
-		"1.1.1.1":              false,
-		"93.184.216.34":        false, // example.com
-		"64:ff9b::808:808":     false, // NAT64 8.8.8.8 (public → allowed)
-		"2606:4700:4700::1111": false, // public IPv6 (Cloudflare)
+		"127.0.0.1":                true,
+		"::1":                      true,
+		"0.0.0.0":                  true,
+		"10.0.0.1":                 true,
+		"172.16.0.1":               true,
+		"192.168.1.1":              true,
+		"169.254.169.254":          true,  // AWS metadata
+		"100.64.0.1":               true,  // CGNAT
+		"224.0.0.1":                true,  // multicast
+		"::ffff:127.0.0.1":         true,  // IPv4-mapped loopback
+		"::ffff:10.0.0.1":          true,  // IPv4-mapped private
+		"::127.0.0.1":              true,  // IPv4-compatible loopback
+		"::10.0.0.1":               true,  // IPv4-compatible private
+		"64:ff9b::7f00:1":          true,  // NAT64 WKP 127.0.0.1
+		"64:ff9b::a00:1":           true,  // NAT64 WKP 10.0.0.1
+		"64:ff9b::a9fe:a9fe":       true,  // NAT64 WKP 169.254.169.254 (metadata)
+		"64:ff9b:1::a9fe:a9fe":     true,  // NAT64 local-use prefix (blocked wholesale, RFC 8215)
+		"64:ff9b:1::a00:1":         true,  // NAT64 local-use prefix (blocked wholesale)
+		"64:ff9b:1::808:808":       true,  // NAT64 local-use prefix (blocked wholesale even for public embed)
+		"2002:a9fe:a9fe::":         true,  // 6to4 (blocked wholesale, RFC 3056/7526)
+		"2002:a00:1::":             true,  // 6to4 (blocked wholesale)
+		"2002:7f00:1::":            true,  // 6to4 (blocked wholesale)
+		"2002:808:808::":           true,  // 6to4 (blocked wholesale even for public embed)
+		"2001::5601:5601":          true,  // Teredo (blocked wholesale, client field)
+		"2001::f5ff:fffe":          true,  // Teredo (blocked wholesale)
+		"2001:0:a00:1::":           true,  // Teredo (blocked wholesale, private server field bytes [4:8])
+		"2001::808:808":            true,  // Teredo (blocked wholesale even for public embed)
+		"2001:db8::5efe:a9fe:a9fe": true,  // ISATAP 169.254.169.254 (metadata)
+		"2001:db8::200:5efe:a00:1": true,  // ISATAP 10.0.0.1 (global-scope u/g bit)
+		"2001:db8::5efe:808:808":   false, // ISATAP 8.8.8.8 (public → allowed)
+		"::ffff:0:7f00:1":          true,  // SIIT IPv4-translated 127.0.0.1
+		"::ffff:0:a00:1":           true,  // SIIT IPv4-translated 10.0.0.1
+		"::ffff:0:a9fe:a9fe":       true,  // SIIT IPv4-translated 169.254.169.254 (metadata)
+		"::ffff:0:808:808":         false, // SIIT IPv4-translated 8.8.8.8 (public → allowed)
+		"8.8.8.8":                  false,
+		"1.1.1.1":                  false,
+		"93.184.216.34":            false, // example.com
+		"64:ff9b::808:808":         false, // NAT64 WKP 8.8.8.8 (public → allowed)
+		"2606:4700:4700::1111":     false, // public IPv6 (Cloudflare)
 	}
 	for raw, blocked := range cases {
 		t.Run(raw, func(t *testing.T) {
