(maka) branch main updated: fix(runtime): reject malformed bypass CIDRs (#3918)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

Astro-Han pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/maka.git


The following commit(s) were added to refs/heads/main by this push:
     new 3b89474c4 fix(runtime): reject malformed bypass CIDRs (#3918)
3b89474c4 is described below

commit 3b89474c47bd79e20d075e210b450859d4fcbfde
Author: NekoPunch <95...@users.noreply.github.com>
AuthorDate: Wed Aug 26 04:12:35 2026 -0700

    fix(runtime): reject malformed bypass CIDRs (#3918)
    
    Malformed CIDR coercion could route requests outside the configured proxy.
    
    Generated-by: OpenAI Codex
---
 packages/runtime/src/network/__tests__/bypass-matcher.test.ts | 7 +++++++
 packages/runtime/src/network/bypass-matcher.ts                | 7 +++++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/packages/runtime/src/network/__tests__/bypass-matcher.test.ts b/packages/runtime/src/network/__tests__/bypass-matcher.test.ts
index eb96f6f59..73c079e42 100644
--- a/packages/runtime/src/network/__tests__/bypass-matcher.test.ts
+++ b/packages/runtime/src/network/__tests__/bypass-matcher.test.ts
@@ -45,4 +45,11 @@ describe('matchesBypassList', () => {
     expect(matchesBypassList('LocalHost', list)).toBe(true);
     expect(matchesBypassList('anything', ['*'])).toBe(true);
   });
+
+  test('rejects malformed CIDR entries', () => {
+    expect(matchesBypassList('10.0.0.1', ['10.0.0.0/24.5'])).toBe(false);
+    expect(matchesBypassList('10.0.0.1', ['10.0.0.0/24/ignored'])).toBe(false);
+    expect(matchesBypassList('10.0.0.1', ['10.0.0.0/'])).toBe(false);
+    expect(matchesBypassList('10.0.0.1', ['1e1.0.0.0/8'])).toBe(false);
+  });
 });
diff --git a/packages/runtime/src/network/bypass-matcher.ts b/packages/runtime/src/network/bypass-matcher.ts
index bb21af8e2..66285a425 100644
--- a/packages/runtime/src/network/bypass-matcher.ts
+++ b/packages/runtime/src/network/bypass-matcher.ts
@@ -34,9 +34,12 @@ export function matchesBypassList(host: string, bypassList: string[]): boolean {
 }
 
 function matchesCidr(ip: string, cidr: string): boolean {
-  const [base, prefixRaw] = cidr.split('/');
+  const parts = cidr.split('/');
+  if (parts.length !== 2) return false;
+  const [base, prefixRaw] = parts;
+  if (isIP(base) !== 4 || !/^\d+$/.test(prefixRaw)) return false;
   const prefix = Number(prefixRaw);
-  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32) return false;
+  if (prefix > 32) return false;
   const ipInt = ipv4ToInt(ip);
   const baseInt = ipv4ToInt(base);
   if (ipInt === null || baseInt === null) return false;


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org