(address: string)
| 53 | } |
| 54 | |
| 55 | function isBlockedV4(address: string): boolean { |
| 56 | const parts = address.split('.').map(Number) |
| 57 | const [a, b] = parts |
| 58 | if ( |
| 59 | parts.length !== 4 || |
| 60 | a === undefined || |
| 61 | b === undefined || |
| 62 | parts.some(n => Number.isNaN(n)) |
| 63 | ) { |
| 64 | return false |
| 65 | } |
| 66 | |
| 67 | // Loopback explicitly allowed |
| 68 | if (a === 127) return false |
| 69 | |
| 70 | // 0.0.0.0/8 |
| 71 | if (a === 0) return true |
| 72 | // 10.0.0.0/8 |
| 73 | if (a === 10) return true |
| 74 | // 169.254.0.0/16 — link-local, cloud metadata |
| 75 | if (a === 169 && b === 254) return true |
| 76 | // 172.16.0.0/12 |
| 77 | if (a === 172 && b >= 16 && b <= 31) return true |
| 78 | // 100.64.0.0/10 — shared address space (RFC 6598, CGNAT). Some cloud |
| 79 | // providers use this range for metadata endpoints (e.g. Alibaba Cloud at |
| 80 | // 100.100.100.200). |
| 81 | if (a === 100 && b >= 64 && b <= 127) return true |
| 82 | // 192.168.0.0/16 |
| 83 | if (a === 192 && b === 168) return true |
| 84 | |
| 85 | return false |
| 86 | } |
| 87 | |
| 88 | function isBlockedV6(address: string): boolean { |
| 89 | const lower = address.toLowerCase() |
no outgoing calls
no test coverage detected