From a736e156bbdc6995caa3b89efefc36fb1d41fbde Mon Sep 17 00:00:00 2001
From: MengMengCode <227010654+MengMengCode@users.noreply.github.com>
Date: Tue, 4 Aug 2026 05:13:45 +0800
Subject: [PATCH] fix something

---
 backend/internal/safehttp/safehttp.go      | 9 ++++++---
 backend/internal/safehttp/safehttp_test.go | 4 ++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/backend/internal/safehttp/safehttp.go b/backend/internal/safehttp/safehttp.go
index 42f233a..f39d19a 100644
--- a/backend/internal/safehttp/safehttp.go
+++ b/backend/internal/safehttp/safehttp.go
@@ -16,6 +16,7 @@ const maxRedirects = 10
 
 var blockedDownloadPrefixes = []netip.Prefix{
 	netip.MustParsePrefix("0.0.0.0/8"),
+	netip.MustParsePrefix("100.100.100.200/32"),
 	netip.MustParsePrefix("127.0.0.0/8"),
 	netip.MustParsePrefix("169.254.0.0/16"),
 	netip.MustParsePrefix("192.0.0.0/24"),
@@ -36,6 +37,7 @@ var blockedDownloadPrefixes = []netip.Prefix{
 	netip.MustParsePrefix("2001:db8::/32"),
 	netip.MustParsePrefix("2001:20::/28"),
 	netip.MustParsePrefix("2002::/16"),
+	netip.MustParsePrefix("fd00:ec2::254/128"),
 	netip.MustParsePrefix("fec0::/10"),
 	netip.MustParsePrefix("fe80::/10"),
 	netip.MustParsePrefix("ff00::/8"),
@@ -114,9 +116,10 @@ func Get(ctx context.Context, rawURL, userAgent string, timeout time.Duration) (
 		},
 	}
 
-	// All URL components, redirects, DNS answers and dial destinations are
-	// constrained above and in restrictedTransport.
-	// lgtm[go/request-forgery]
+	// The URL, redirects, DNS answers and dial destinations are constrained
+	// above and in restrictedTransport. CodeQL cannot infer those checks across
+	// the custom transport boundary.
+	// codeql[go/request-forgery]
 	return client.Do(request)
 }
 
diff --git a/backend/internal/safehttp/safehttp_test.go b/backend/internal/safehttp/safehttp_test.go
index 80d9295..07d6479 100644
--- a/backend/internal/safehttp/safehttp_test.go
+++ b/backend/internal/safehttp/safehttp_test.go
@@ -18,6 +18,8 @@ func TestValidateURLRejectsUnsafeDestinations(t *testing.T) {
 		"http://127.0.0.1/image",
 		"http://[::1]/image",
 		"http://169.254.169.254/latest/meta-data",
+		"http://100.100.100.200/latest/meta-data",
+		"http://[fd00:ec2::254]/latest/meta-data",
 		"http://example.com:99999/image",
 	} {
 		if _, err := ValidateURL(rawURL); err == nil {
@@ -64,12 +66,14 @@ func TestIsAllowedDownloadAddress(t *testing.T) {
 		"172.16.0.1":           true,
 		"192.168.1.1":          true,
 		"169.254.169.254":      false,
+		"100.100.100.200":      false,
 		"192.0.2.1":            false,
 		"198.18.0.1":           false,
 		"::1":                  false,
 		"64:ff9b::127.0.0.1":   false,
 		"2002:7f00:1::1":       false,
 		"fc00::1":              true,
+		"fd00:ec2::254":        false,
 		"fec0::1":              false,
 		"fe80::1":              false,
 		"2001:db8::1":          false,