Repository navigation
v0.1.1
prism-ai-browser 0.1.1 — security fix
No breaking changes.
SECURITY: BrowserPolicy promises to refuse a private address even when the
host is allow-listed. This port judged addresses by is_private, is_loopback
and is_link_local, which admitted 100.100.100.200 (Alibaba Cloud's metadata
endpoint, in CGNAT), multicast, the NAT64 spellings of 169.254.169.254 and
IPv4-compatible loopback, and did not see shorthand IPv4 a browser resolves
to loopback (127.1, 0x7f000001, 2130706433, 0177.0.0.1) as an address at
all. If you allow-list IP literals, upgrade.
- The check is now the explicit list core's guarded media fetch uses,
identical in every language. - NAT64 and 6to4 addresses are judged by the IPv4 address they embed. A
public 6to4 address, which 0.1.0 refused, now navigates. - Shorthand IPv4 is read with inet_aton, as libc does, without DNS.