@@ -402,8 +402,8 @@ else (if take 1 s == c then 1 else 0) + countChar c (drop 1 s)
403-- Block private/reserved/internal hostnames (SSRF defense). Skips obscure encoding
403-- Block private/reserved/internal hostnames (SSRF defense). Skips obscure encoding
404-- tricks (octal, hex, percent-encoding) but covers the high-value cases:
404-- tricks (octal, hex, percent-encoding) but covers the high-value cases:
405−-- `localhost`, RFC1918 ranges (10/8, 192.168/16, 169.254/16), the IPv4 zero
405+-- `localhost`, RFC1918 ranges (10/8, 172.16/12, 192.168/16) plus link-local
406−-- net, bare IPv6 literals (any string with more than one `:` — covers loopback
406+-- 169.254/16, the IPv4 zero net, bare IPv6 literals (any string with more than one `:` — covers loopback
407-- `::`/`::1`, link-local `fe80::/10`, ULA `fc00::/7`, globals like `2001:db8::1`),
407-- `::`/`::1`, link-local `fe80::/10`, ULA `fc00::/7`, globals like `2001:db8::1`),
408-- bracketed IPv6 literals, and the `.local` / `.internal` / `.arpa` / `.onion`
408-- bracketed IPv6 literals, and the `.local` / `.internal` / `.arpa` / `.onion`
409-- suffixes. Called at federation egress (so we never `fetch` a peer pubkey from
409-- suffixes. Called at federation egress (so we never `fetch` a peer pubkey from
@@ -419,7 +419,23 @@ isBadServerName = \sn -> sn == "" || sn == "localhost" || any (\c -> not contain
420 "192.168.",
420 "192.168.",
421 "169.254.",
421 "169.254.",
423] || any (\s -> hasSuffix s sn) [".localhost", ".local", ".internal", ".arpa", ".onion"]
439] || any (\s -> hasSuffix s sn) [".localhost", ".local", ".internal", ".arpa", ".onion"]
425-- ============================================
441-- ============================================