dualfroz
cce89ba4a2
parse_url() keeps the brackets around an IPv6 literal, so "[::1]" or "[::ffff:127.0.0.1]" never matched an address and isPrivateURL() let the request through. A host that does not resolve was allowed for the same reason, while cURL still connects to forms like "0x7f000001" or "127.0.0.1." on its own. Strip the brackets and the trailing dot, check IP literals directly, check every resolved address, and treat a host without any address as private. IPv4-mapped IPv6 addresses are checked through their IPv4 part, since FILTER_FLAG_NO_RES_RANGE does not classify them the same way on every PHP version. Fixes #5858 Fixes #5871