[HighestFidelity]

The image-from-URL fetch already refuses loopback, link-local, unique-local and the other private IPv6 ranges. Two ranges that can still route to the local network got through: site-local fec0::/10 (deprecated, but some LANs still route it) and local-use NAT64 64:ff9b:1::/48 (RFC 8215, which a network can map to its private IPv4 addresses).

What changed:

• is_public_v6 treats fec0::/10 and 64:ff9b:1::/48 as not public, so the fetch refuses them like the other local ranges. The well-known NAT64 prefix 64:ff9b::/96 is still judged by its embedded IPv4 address, as before. The local-use prefix is refused whole, since the IPv4 address can sit at a different offset in it.

Tested:

• Added fec0::1 and 64:ff9b:1::a00:1 to addresses_on_this_pc_or_the_local_network_are_refused.
• cargo fmt --check, cargo test --locked, and clippy with -D warnings for Linux and x86_64-pc-windows-gnu all pass.
• Not tested on a network that actually routes either range.

Thanks for merging the first four so quickly. This is the first of a few more small ones.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Remote image address checks now reject IPv6 site-local addresses and local-use NAT64 addresses, preventing images from being fetched from these additional non-public address ranges.
  • Added coverage for both address ranges.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The IPv6 public-address check now rejects site-local addresses and addresses in the local-use NAT64 prefix. The address-refusal test includes examples from both ranges.

Changes: IPv6 Address Refusal

Layer / File(s)	Summary
Reject additional IPv6 ranges src/remote_image.rs	is_public_v6 treats site-local IPv6 and local-use NAT64 addresses as non-public. The address-refusal test covers both ranges.

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: snekxs

Merge Risk: Minimal · up to c5764

The image-from-URL fetch now refuses two more IPv6 ranges that can reach local networks. No merge-blocking risk was identified.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names the fix (refusing site-local and local-use NAT64 IPv6 ranges in remote image fetches) and the component (remote-image). The raw summary and PR objectives both describe this exact chang…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names the fix (refusing site-local and local-use NAT64 IPv6 ranges in remote image fetches) and the component (remote-image). The raw summary and PR objectives both describe this exact change, so the title matches the main change. It is specific and reads clearly. The title is long at 101 characters, but it still conveys the primary change.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: OpenMouse-Project/OpenMouse-Bridge
• Branch: main
• File: .coderabbit.yaml
• Commit: 86974b1
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d92eba27-36db-40fd-84d8-b8938d368448

Commits

Reviewing files that changed from the base of the PR and between 86974b1 and c57645e.

Files selected for processing: 1

• src/remote_image.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.