User 9df80b73e2 fix: allow RFC2544 benchmark range (198.18.0.0/15) through SSRF filter ...

Telegram's API and file servers resolve to IPs in the 198.18.0.0/15
range (RFC 2544 benchmarking range). The SSRF filter was blocking these
addresses because ipaddr.js classifies them as 'reserved', and the
filter also had an explicit RFC2544_BENCHMARK_PREFIX check that blocked
them unconditionally.

Fix: exempt 198.18.0.0/15 from the 'reserved' range block in
isBlockedSpecialUseIpv4Address(). Other 'reserved' ranges (TEST-NET-2,
TEST-NET-3, documentation prefixes) remain blocked. The explicit
RFC2544_BENCHMARK_PREFIX check is repurposed as the exemption guard.

Closes #24973

2026-02-24 03:28:00 +00:00

..

fetch-guard.ssrf.test.ts

fix: allow RFC2544 benchmark range (198.18.0.0/15) through SSRF filter

2026-02-24 03:28:00 +00:00

fetch-guard.ts

Net: strip sensitive headers on cross-origin redirects

2026-02-19 11:42:25 -08:00

hostname.ts

refactor(net): share hostname normalization

2026-02-16 01:01:22 +00:00

ssrf.dispatcher.test.ts

fix(network): normalize SSRF IP parsing and monitor typing

2026-02-22 18:55:34 +01:00

ssrf.pinning.test.ts

fix: allow RFC2544 benchmark range (198.18.0.0/15) through SSRF filter

2026-02-24 03:28:00 +00:00

ssrf.test.ts

fix: allow RFC2544 benchmark range (198.18.0.0/15) through SSRF filter

2026-02-24 03:28:00 +00:00

ssrf.ts

fix(security): harden browser SSRF defaults and migrate legacy key

2026-02-24 01:52:01 +00:00