Finding
ip_is_disallowed() (line 291) omits the deprecated IPv4-compatible IPv6 embed check (::a.b.c.d, e.g. ::127.0.0.1, ::169.254.169.254) that the sibling paroche/net_validate.rs explicitly added (to_ipv4_mapped only matches ::ffff:*), so a literal like http://[::127.0.0.1]/x passes validate_fetch_url unchecked — an unambiguous inconsistency between two near-identical validators, one hardened (with tests) and one not.
Evidence
crates/zetesis/src/client/mod.rs:291. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).
Why this matters
A deprecated IPv4-compatible IPv6 literal (e.g. embedding a loopback or cloud-metadata address) bypasses zetesis's SSRF validation entirely — an inconsistency with the hardened sibling validator that already covers this case.
Desired correction
Port net_validate.rs's ::a.b.c.d embed handling into ip_is_disallowed (detect the ::/96 compatible form, extract the embedded v4, and judge it against the disallow list), and add the matching test cases zetesis currently lacks.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.
Finding
ip_is_disallowed() (line 291) omits the deprecated IPv4-compatible IPv6 embed check (::a.b.c.d, e.g. ::127.0.0.1, ::169.254.169.254) that the sibling paroche/net_validate.rs explicitly added (to_ipv4_mapped only matches ::ffff:*), so a literal like http://[::127.0.0.1]/x passes validate_fetch_url unchecked — an unambiguous inconsistency between two near-identical validators, one hardened (with tests) and one not.
Evidence
crates/zetesis/src/client/mod.rs:291. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).Why this matters
A deprecated IPv4-compatible IPv6 literal (e.g. embedding a loopback or cloud-metadata address) bypasses zetesis's SSRF validation entirely — an inconsistency with the hardened sibling validator that already covers this case.
Desired correction
Port net_validate.rs's ::a.b.c.d embed handling into ip_is_disallowed (detect the ::/96 compatible form, extract the embedded v4, and judge it against the disallow list), and add the matching test cases zetesis currently lacks.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.