fix(url_safety): handle DNS64/NAT64 synthesized addresses in SSRF check - #38071
Closed
Elshayib wants to merge 3 commits into
Closed
fix(url_safety): handle DNS64/NAT64 synthesized addresses in SSRF check#38071Elshayib wants to merge 3 commits into
Elshayib wants to merge 3 commits into
Conversation
added 3 commits
June 3, 2026 08:37
…t cleanup - web_server.py: after proc.poll() returns a non-None exit code, call proc.wait() to reap the child and move the entry from _ACTION_PROCS to _ACTION_RESULTS. Previously .poll() alone left <defunct> zombies. - meet_bot.py: terminate and wait on the pcm_pump subprocess (paplay/ ffmpeg) during the finally-block teardown. Previously leaked on every normal bot exit. - tests: add test_action_status_reaps_completed_process and test_action_status_ignores_wait_failure covering both the happy path and the wait()-raises-OSError edge case. Closes #38032
The copytree ignore lambda in _copy_dist_payload applied USER_OWNED_EXCLUDE recursively at every directory depth. This caused nested directories whose names matched exclude entries (bin, logs, cache, etc.) to be silently dropped during distribution install/update. Fix: only apply USER_OWNED_EXCLUDE filtering at the root of the staged tree, matching the two-tier pattern used by _clone_all_copytree_ignore and _default_export_ignore in profiles.py. Add 5 tests covering nested bin/logs/cache preservation and top-level filtering still working. Fixes #37954
_is_blocked_ip treated IPv6 addresses in the 64:ff9b::/96 well-known prefix as reserved and blocked them unconditionally. This caused false-positive blocks when DNS64 resolvers returned synthesized AAAA records for legitimate public hosts (e.g. www.bhphotovideo.com -> 64:ff9b::6812:27e4 which embeds 104.18.39.228). Add NAT64 handling matching the existing ipv4_mapped pattern: extract the embedded IPv4 address from the last 32 bits and run the standard IPv4 SSRF checks on that instead of relying on ip.is_reserved. Dangerous embedded targets (169.254.169.254, 10.x, 127.x, etc.) remain blocked; public embedded targets are correctly allowed. Add 6 NAT64 parametrize cases to TestIsBlockedIp and 6 integration tests in TestNat64 covering public allowed, private blocked, loopback blocked, metadata blocked, toggle interaction, and mixed DNS responses. All 128 tests in test_url_safety.py pass. Fixes #38048
alt-glitch
added
type/bug
Collaborator
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_is_blocked_iptreated IPv6 addresses in the64:ff9b::/96well-known prefix as reserved and blocked them unconditionally. This caused false-positive blocks when DNS64 resolvers returned synthesized AAAA records for legitimate public hosts (e.g.www.bhphotovideo.com->64:ff9b::6812:27e4which embeds104.18.39.228).Fix
Added NAT64 handling matching the existing
ipv4_mappedpattern: extract the embedded IPv4 address from the last 32 bits and run the standard IPv4 SSRF checks on that instead of relying onip.is_reserved.169.254.169.254,10.x,127.x, etc.) remain blockedTests
TestIsBlockedIp(3 blocked, 3 allowed)TestNat64class covering:is_safe_urlallow_private_urlstoggle interactionAll 128 tests in
test_url_safety.pypass.Fixes #38048