50c 3.9.3 → 3.9.5

package/lib/backdoor-checker.js

@@ -18,6 +18,7 @@ const { exec, execSync } = require('child_process');
 const os = require('os');
 const fs = require('fs');
 const path = require('path');
+const { isPrivateIP, isValidIPv4, extractPublicIPs } = require('./ip-utils');
 
 const PLATFORM = os.platform(); // win32, linux, darwin
 const HOME = os.homedir();
@@ -664,13 +665,8 @@ async function runAudit(options = {}) {
   const allIPs = new Set();
   for (const f of result.findings) {
     if (typeof f.data === 'string') {
-      const ipMatches = f.data.match(/\b(?:\d{1,3}\.){3}\d{1,3}\b/g) || [];
-      for (const ip of ipMatches) {
-        if (!ip.startsWith('127.') && !ip.startsWith('0.') && !ip.startsWith('10.') &&
-            !ip.startsWith('192.168.') && !ip.startsWith('169.254.') &&
-            !ip.match(/^172\.(1[6-9]|2\d|3[01])\./)) {
-          allIPs.add(ip);
-        }
+      for (const ip of extractPublicIPs(f.data)) {
+        allIPs.add(ip);
       }
     }
   }

package/lib/ip-utils.js

@@ -0,0 +1,47 @@
+/**
+ * 50c IP Utilities — shared by backdoor-checker and pre-publish
+ * Classifies IPs as private/public, validates format, extracts from text
+ */
+
+function isPrivateIP(ip) {
+  if (!ip || typeof ip !== 'string') return true;
+  // IPv6 private
+  if (ip === '::1' || ip.startsWith('fe80:') || ip.startsWith('fc') || ip.startsWith('fd')) return true;
+  // IPv4 private/reserved ranges
+  if (ip.startsWith('127.')) return true;
+  if (ip.startsWith('0.')) return true;
+  if (ip.startsWith('10.')) return true;
+  if (ip.startsWith('192.168.')) return true;
+  if (ip.startsWith('169.254.')) return true;
+  if (ip.match(/^172\.(1[6-9]|2\d|3[01])\./)) return true;
+  // Multicast and broadcast
+  if (ip.startsWith('224.') || ip.startsWith('255.')) return true;
+  return false;
+}
+
+function isValidIPv4(ip) {
+  if (!ip || typeof ip !== 'string') return false;
+  const parts = ip.split('.');
+  if (parts.length !== 4) return false;
+  return parts.every(p => {
+    const n = parseInt(p, 10);
+    return !isNaN(n) && n >= 0 && n <= 255 && String(n) === p;
+  });
+}
+
+function extractPublicIPs(text) {
+  if (!text || typeof text !== 'string') return [];
+  const ipPattern = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
+  const matches = text.match(ipPattern) || [];
+  const publicIPs = [];
+  const seen = new Set();
+  for (const ip of matches) {
+    if (!seen.has(ip) && isValidIPv4(ip) && !isPrivateIP(ip)) {
+      seen.add(ip);
+      publicIPs.push(ip);
+    }
+  }
+  return publicIPs;
+}
+
+module.exports = { isPrivateIP, isValidIPv4, extractPublicIPs };