Upstream contribution · zhayujie/CowAgent
CowAgent · Block shared address space in CowAgent's URL guard
Problem
CowAgent's opt-in SSRF guard enumerated several private address categories. Shared IPv4 addresses in 100.64.0.0/10 could pass the checks, including an address used for a cloud instance metadata endpoint.
Engineering response
Require global reachability alongside the existing address checks. The guard now rejects shared addresses while keeping ordinary public IPv4 and IPv6 addresses admissible.
Evidence and scope
The pull request reports eight local tests passing with the change. Reverting it caused the two new shared-address cases to fail. The tests exercise address classification.