Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(security): URL import with own range check and a generic error (audit M3, cheap part)

Browse Source 
PublicAddress blocks every private/reserved IPv4 and IPv6 range
(169.254/16, 100.64/10, fc00::/7, fe80::/10, IPv4-mapped/NAT64/6to4 by
their embedded address, ...) independent of the core version; checked
before the request and on every redirect (Requests before_redirect).
Network failures return only "Die Datei konnte nicht geladen werden.";
the detail goes to the error log. DNS-rebinding pinning stays deferred.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 19:27:11 +02:00
co-authored by Claude Opus 5.5
parent 0531a5ffb1
commit 7f361304ae
8 changed files with 318 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/bootstrap.php
+1
View File
@@ -15,3 +15,4 @@ require_once __DIR__ . '/Stubs/WpPost.php';
require_once __DIR__ . '/Stubs/WpTerm.php';
require_once __DIR__ . '/Stubs/WpApplicationPasswords.php';
require_once __DIR__ . '/Stubs/WpListTable.php';
require_once __DIR__ . '/Stubs/RequestsException.php';