codeql

mirror of https://github.com/github/codeql.git synced 2026-06-12 00:11:07 +02:00

Files

tonghuaroot e93bc11f6f Add experimental JS query for SSRF guards missing IPv6-transition unwrap

Add javascript/ssrf-ipv6-transition-incomplete-guard, an experimental
@kind problem query that flags hand-rolled SSRF host guards which reject
private/loopback IPv4 ranges but never unwrap IPv6-transition forms
(IPv4-mapped ::ffff:, NAT64 64:ff9b::, 6to4 2002::). Such guards can be
bypassed by wrapping an internal IPv4 address in a transition literal.

Includes a .qhelp with good/bad examples, a change note, and a test pack
with two true-positive fixtures (private-ip package guard and a
hand-written RFC 1918 denylist) and two negative-control fixtures
(ipaddr.js range classifier and an explicit ::ffff: unwrap).

Signed-off-by: tonghuaroot <23011166+tonghuaroot@users.noreply.github.com>

2026-06-06 21:47:24 +08:00

ApiGraphs

JS: Localize charpred of API::EntryPoint

2026-01-07 11:05:41 +01:00

experimental

Add experimental JS query for SSRF guards missing IPv6-transition unwrap

2026-06-06 21:47:24 +08:00

library-tests

Model res.json and res.jsonp as Vercel response sinks

2026-04-28 16:14:53 +00:00

query-tests

Regenerate DatabaseAccesses.expected for new vercel.ts fixture