I Tested My Own SSRF Guard and [::1] Walked Straight Through
Two of my products fetch URLs that users give them. While writing about server-side request forgery, I threw a list of tricky addresses at my own guard. The URL parser was hiding the bug.
Two of my products fetch URLs that users give them. While writing about server-side request forgery, I threw a list of tricky addresses at my own guard. The URL parser was hiding the bug.