[VasiliyRad]

Security: SSRF bypass

_is_safe_callback_url in src/agent-api.py loops getaddrinfo results against a private-IP range list. For IPv4-mapped IPv6 addresses (::ffff:127.0.0.1 and similar), Python's ipaddress cross-family in check is always False:

```python

import ipaddress
ipaddress.ip_address('::ffff:127.0.0.1') in ipaddress.ip_network('127.0.0.0/8')
False # cross-family
```

So a webhook URL of https://[::ffff:127.0.0.1]/exfil passes the validator even though it resolves to localhost. Same gap for any RFC1918 target (::ffff:10.0.0.5 → 10.0.0.5).

Practical exploit is TLS-gated — no public cert covers IPv6 IP literals, so urllib.request.urlopen on this URL fails certificate validation. But defense-in-depth says the validator MUST catch it — the docstring explicitly claims to block "Hostnames that resolve to private IPs" and the SSRF allowlist is the canonical guard for callback URLs.

Fix

After the existing per-address loop, if the address is an IPv6Address with ipv4_mapped set, project the mapped IPv4 onto the IPv4 private-range checks. Catches the bypass with no change to the existing IPv4 / pure-IPv6 paths.

Note on 6to4 / Teredo: 6to4 (2002::/16) and Teredo (2001::/32) are public-routable IPv6 tunneling schemes whose embedded IPv4 is the encapsulating endpoint, not the destination — projecting those onto private-IPv4 checks would generate false positives. Only v4-mapped (::ffff:0:0/96) needs the projection.

Tests

tests/agent-api-ssrf-ipv4-mapped-ipv6.test.py (6 cases). Monkey-patches socket.getaddrinfo so each case deterministically simulates a DNS response — no network dependency.

Case	Pins
test_ipv4_mapped_ipv6_loopback_is_blocked	The core bypass closed — ::ffff:127.0.0.1 rejected.
test_ipv4_mapped_ipv6_rfc1918_is_blocked	::ffff:10.0.0.5 (RFC1918 generalization) rejected.
test_plain_ipv4_loopback_still_blocked	No regression on plain 127.0.0.1.
test_plain_ipv6_loopback_still_blocked	No regression on plain ::1.
test_public_ipv6_still_passes	Public IPv6 (Cloudflare DNS) still allowed — guards against over-zealous fix that rejects all IPv6.
test_public_ipv4_still_passes	Public IPv4 (1.1.1.1) still allowed.

Test plan

• python3 tests/agent-api-ssrf-ipv4-mapped-ipv6.test.py — 6/6 pass
• python3 -c "import ast; ast.parse(open('src/agent-api.py').read())" — syntax check
• Manual: register a webhook with https://[::ffff:127.0.0.1]/, trigger a task completion, verify [webhook] BLOCKED appears in logs

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[sonichi]

LGTM. The bug is real: Python's ipaddress cross-family in check returns False, so ::ffff:127.0.0.1 passes the private-IP loop today. Practical exploit is TLS-gated (no public cert covers IPv6 IP literals → urllib.request.urlopen fails cert validation) — but defense-in-depth says the validator must catch it; the docstring explicitly claims to block private-IP-resolving hostnames.

Fix uses IPv6Address.ipv4_mapped to project onto the IPv4 private-range checks. Correctly excludes 6to4 (2002::/16) and Teredo (2001::/32) — those tunnels embed the encapsulating endpoint's IPv4, not the destination's, and projecting them would generate false positives. PR body calls this out explicitly which is a strong signal.

Tests monkey-patch socket.getaddrinfo for deterministic DNS simulation — clean shape, no network dependency.