refactor(url-security): consolidate blocked IPv4 ranges into one CIDR table (SEC-024)

Addresses Codacy review on PR #147: fold RFC1918/loopback/link-local/unspecified
into BLOCKED_V4_CIDRS so every blocked range is enforced by the same integer match
and the full blocklist is auditable at a glance, instead of a mix of startsWith,
a 172.16-31 regex, and the bitwise loop. isPrivateIpv4 is now just the isIP guard
plus the CIDR match. Also add 6to4 relay anycast (192.88.99.0/24, RFC 7526).
Behavior-preserving for the folded ranges (added both-sided boundary tests to
prove it; existing url-reader DNS tests for 127/10/192.168/172.16/169.254 still
assert blocking). SECURITY.md updated with 192.88.99.0/24.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: ihor-sokoliuk

SECURITY.md

@@ -45,7 +45,7 @@ The primary security surface areas are:
 Private and internal URLs are **blocked by default** in all transport modes. The following are rejected:
 
 - `localhost` and `*.localhost`
-- IPv4 loopback (`127.0.0.0/8`), private (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), link-local (`169.254.0.0/16`), unspecified (`0.0.0.0/8`), CGNAT (`100.64.0.0/10`), IETF protocol assignments (`192.0.0.0/24`), documentation/test ranges (`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`), benchmarking (`198.18.0.0/15`), multicast (`224.0.0.0/4`), and reserved/broadcast (`240.0.0.0/4`) ranges
+- IPv4 loopback (`127.0.0.0/8`), private (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`), link-local (`169.254.0.0/16`), unspecified (`0.0.0.0/8`), CGNAT (`100.64.0.0/10`), IETF protocol assignments (`192.0.0.0/24`), 6to4 relay anycast (`192.88.99.0/24`), documentation/test ranges (`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`), benchmarking (`198.18.0.0/15`), multicast (`224.0.0.0/4`), and reserved/broadcast (`240.0.0.0/4`) ranges
 - IPv6 loopback (`::1`), unspecified (`::`), ULA (`fc00::/7`), link-local (`fe80::/10`)
 - IPv4-mapped IPv6 addresses that resolve to any of the above (e.g. `::ffff:127.0.0.1`)
 - Redirects are validated **before** they are followed — a public URL that redirects to a private address is also blocked

__tests__/unit/url-security.test.ts

@@ -49,6 +49,38 @@ async function runTests() {
     assert.equal(isPrivateIpv4('100.128.0.5'), false);
   }, results);
 
+  await testFunction('isPrivateIpv4 blocks RFC1918, loopback, link-local, and unspecified ranges', () => {
+    // unspecified 0.0.0.0/8
+    assert.equal(isPrivateIpv4('0.0.0.0'), true);
+    assert.equal(isPrivateIpv4('0.255.255.255'), true);
+    // 10.0.0.0/8 boundaries
+    assert.equal(isPrivateIpv4('10.0.0.1'), true);
+    assert.equal(isPrivateIpv4('9.255.255.255'), false);
+    assert.equal(isPrivateIpv4('11.0.0.0'), false);
+    // loopback 127.0.0.0/8
+    assert.equal(isPrivateIpv4('127.0.0.1'), true);
+    assert.equal(isPrivateIpv4('126.255.255.255'), false);
+    // link-local 169.254.0.0/16 boundaries
+    assert.equal(isPrivateIpv4('169.254.169.254'), true);
+    assert.equal(isPrivateIpv4('169.253.255.255'), false);
+    assert.equal(isPrivateIpv4('169.255.0.0'), false);
+    // RFC1918 172.16.0.0/12 boundaries
+    assert.equal(isPrivateIpv4('172.16.0.0'), true);
+    assert.equal(isPrivateIpv4('172.31.255.255'), true);
+    assert.equal(isPrivateIpv4('172.15.255.255'), false);
+    assert.equal(isPrivateIpv4('172.32.0.0'), false);
+    // RFC1918 192.168.0.0/16 boundaries
+    assert.equal(isPrivateIpv4('192.168.0.1'), true);
+    assert.equal(isPrivateIpv4('192.167.255.255'), false);
+    assert.equal(isPrivateIpv4('192.169.0.0'), false);
+  }, results);
+
+  await testFunction('isPrivateIpv4 blocks 6to4 relay anycast (192.88.99.0/24)', () => {
+    assert.equal(isPrivateIpv4('192.88.99.1'), true);
+    assert.equal(isPrivateIpv4('192.88.98.255'), false);
+    assert.equal(isPrivateIpv4('192.88.100.0'), false);
+  }, results);
+
   await testFunction('isPrivateIPv6 delegates IPv4-mapped CGNAT addresses to IPv4 check', () => {
     assert.equal(isPrivateIPv6('::ffff:100.64.0.1'), true);
   }, results);

src/url-security.ts

@@ -13,11 +13,20 @@ function ipv4ToInt(ip: string): number {
   return ip.split(".").reduce((acc, octet) => (acc << 8) + Number(octet), 0) >>> 0;
 }
 
-// IANA special-purpose IPv4 ranges beyond the existing RFC1918/link-local checks.
+// Blocked IPv4 ranges — RFC1918 private space plus IANA special-purpose ranges
+// (RFC 6890). Kept as a single CIDR table so every range is enforced by the same
+// integer match and the full blocklist is auditable at a glance. Sorted by network.
 const BLOCKED_V4_CIDRS: [number, number][] = [
+  [ipv4ToInt("0.0.0.0"), 8],       // "this" network / unspecified
+  [ipv4ToInt("10.0.0.0"), 8],      // RFC1918 private
   [ipv4ToInt("100.64.0.0"), 10],   // CGNAT (RFC 6598) - Tailscale default, overlays
+  [ipv4ToInt("127.0.0.0"), 8],     // loopback
+  [ipv4ToInt("169.254.0.0"), 16],  // link-local
+  [ipv4ToInt("172.16.0.0"), 12],   // RFC1918 private
   [ipv4ToInt("192.0.0.0"), 24],    // IETF protocol assignments
   [ipv4ToInt("192.0.2.0"), 24],    // TEST-NET-1
+  [ipv4ToInt("192.88.99.0"), 24],  // 6to4 relay anycast (RFC 7526, deprecated)
+  [ipv4ToInt("192.168.0.0"), 16],  // RFC1918 private
   [ipv4ToInt("198.18.0.0"), 15],   // benchmarking (RFC 2544)
   [ipv4ToInt("198.51.100.0"), 24], // TEST-NET-2
   [ipv4ToInt("203.0.113.0"), 24],  // TEST-NET-3
@@ -30,17 +39,6 @@ export function isPrivateIpv4(hostname: string): boolean {
     return false;
   }
 
-  if (
-    hostname.startsWith("0.") ||
-    hostname.startsWith("10.") ||
-    hostname.startsWith("127.") ||
-    hostname.startsWith("192.168.") ||
-    /^172\.(1[6-9]|2\d|3[0-1])\./.test(hostname) ||
-    hostname.startsWith("169.254.")
-  ) {
-    return true;
-  }
-
   const ip = ipv4ToInt(hostname);
   return BLOCKED_V4_CIDRS.some(([net, bits]) => ((ip ^ net) >>> (32 - bits)) === 0);
 }