release: v1.1.29

backend/internal/safehttp/safehttp.go

@@ -16,6 +16,7 @@ const maxRedirects = 10
 
 var blockedDownloadPrefixes = []netip.Prefix{
 	netip.MustParsePrefix("0.0.0.0/8"),
+	netip.MustParsePrefix("100.100.100.200/32"),
 	netip.MustParsePrefix("127.0.0.0/8"),
 	netip.MustParsePrefix("169.254.0.0/16"),
 	netip.MustParsePrefix("192.0.0.0/24"),
@@ -36,6 +37,7 @@ var blockedDownloadPrefixes = []netip.Prefix{
 	netip.MustParsePrefix("2001:db8::/32"),
 	netip.MustParsePrefix("2001:20::/28"),
 	netip.MustParsePrefix("2002::/16"),
+	netip.MustParsePrefix("fd00:ec2::254/128"),
 	netip.MustParsePrefix("fec0::/10"),
 	netip.MustParsePrefix("fe80::/10"),
 	netip.MustParsePrefix("ff00::/8"),
@@ -114,9 +116,10 @@ func Get(ctx context.Context, rawURL, userAgent string, timeout time.Duration) (
 		},
 	}
 
-	// All URL components, redirects, DNS answers and dial destinations are
-	// constrained above and in restrictedTransport.
-	// lgtm[go/request-forgery]
+	// The URL, redirects, DNS answers and dial destinations are constrained
+	// above and in restrictedTransport. CodeQL cannot infer those checks across
+	// the custom transport boundary.
+	// codeql[go/request-forgery]
 	return client.Do(request)
 }
 

backend/internal/safehttp/safehttp_test.go

@@ -18,6 +18,8 @@ func TestValidateURLRejectsUnsafeDestinations(t *testing.T) {
 		"http://127.0.0.1/image",
 		"http://[::1]/image",
 		"http://169.254.169.254/latest/meta-data",
+		"http://100.100.100.200/latest/meta-data",
+		"http://[fd00:ec2::254]/latest/meta-data",
 		"http://example.com:99999/image",
 	} {
 		if _, err := ValidateURL(rawURL); err == nil {
@@ -64,12 +66,14 @@ func TestIsAllowedDownloadAddress(t *testing.T) {
 		"172.16.0.1":           true,
 		"192.168.1.1":          true,
 		"169.254.169.254":      false,
+		"100.100.100.200":      false,
 		"192.0.2.1":            false,
 		"198.18.0.1":           false,
 		"::1":                  false,
 		"64:ff9b::127.0.0.1":   false,
 		"2002:7f00:1::1":       false,
 		"fc00::1":              true,
+		"fd00:ec2::254":        false,
 		"fec0::1":              false,
 		"fe80::1":              false,
 		"2001:db8::1":          false,

backend/internal/version/version.go

@@ -1,7 +1,7 @@
 package version
 
 var (
-	Version = "1.1.28"
+	Version = "1.1.29"
 	Repo    = "MengMengCode/CLICD"
 )
 

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clicd-frontend",
   "private": true,
-  "version": "1.1.28",
+  "version": "1.1.29",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/pages/Login.tsx

@@ -132,7 +132,7 @@ export default function Login() {
           </form>
         </div>
 
-        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.28</p>
+        <p className="text-center text-xs text-gray-400 mt-6">CLICD v1.1.29</p>
       </div>
     </div>
   )