@aborruso/ckan-mcp-server 0.4.118 → 0.4.119

package/LOG.md

@@ -1,5 +1,45 @@
 # LOG
 
+## 2026-08-20
+
+### v0.4.119 - classify IPv6 by value, not by prefix string (GHSA-x32r-mh7g-q2rf)
+
+`0xRomSec` reported that `isBlockedIp` misses the IPv6 ranges that embed an IPv4 address: NAT64 (`64:ff9b::/96`, `64:ff9b:1::/48`), 6to4 (`2002::/16`) and IPv4-compatible (`::/96`). Verified against the real function - all eight cases in the report return `false`. `64:ff9b::a9fe:a9fe` is 169.254.169.254 written in IPv6, and the function is the single decision point for both the literal guard and the DNS-resolution guard, so the gap applied to both halves.
+
+Fixed structurally rather than by appending a fifth prefix: `parseIpv6` expands any spelling (compressed, expanded, upper-case, leading zeros, dotted-quad tail, zone id) into eight 16-bit words, and the classifier decides on values. Unparseable input fails closed. Added `2001::/32` (Teredo) and IPv4 `198.18.0.0/15` as hardening - both embed *public* addresses and open no path to RFC1918, so they sit outside the vector.
+
+The DNS half needed no change: `createSsrfSafeLookup` already passes `all: true` with `family: family || 0` and iterates every result, so an AAAA record was always inspected - it was the classifier that waved it through. Checked before writing the fix, since a `family: 4` there would have made the patch half a fix.
+
+Tests: the eight advisory cases, four non-canonical spellings of the same address, four unparseable literals, `198.18.0.0/15` boundaries, plus three guard-level regressions that exercise the actual bypass chain (literal guard, `assertHostnameResolvesSafe`, connection-time lookup) rather than the classifier alone. 495 passing. Both build targets checked - `http.ts` is shared with the Workers bundle.
+
+## 2026-08-20
+
+### CVE-2026-76811/76812/76813 issued; advisory table added to SECURITY.md
+
+GitHub issued CVEs for the three advisories still pending from the July batch: `GHSA-38f8` (CVE-2026-76811, High), `GHSA-vmrr` (CVE-2026-76812, Critical) and `GHSA-q5gv` (CVE-2026-76813, High). All three were already published and patched (0.4.110 / 0.4.111), so no action was required on the advisories themselves. The 2026-08-15 narrowing round (`GHSA-3369`, `GHSA-v3j5`, `GHSA-c499`, `GHSA-vqff`) is still without an outcome.
+
+`SECURITY.md` now carries a GHSA → CVE → fixed-in table for all thirteen published advisories, plus a supported-versions note. Until now the CVE mapping existed only scattered across LOG entries.
+
+Propagation remains the real gap. `GET /advisories?affects=@aborruso/ckan-mcp-server` still returns only two records (CVE-2026-33060, CVE-2026-53509) out of thirteen published advisories, so Dependabot has never alerted downstream users about the other eleven — including the Critical SSRF-to-cloud-metadata one. CVE-2026-61612 has had its CVE since 2026-06-22 without propagating, which argues against a plain review backlog. Escalated to GitHub Support as ticket **#4682889** (org `ondata`, category Repositories / repository features), 2026-08-20. The portal's AI triage confirmed the reading before letting the ticket through: the documented review window after publication is 72 hours, nothing in the docs describes a further maintainer action to force propagation, and inspecting why some advisories were promoted and others not requires Support. Draft kept in `tmp/github-support-advisory-propagation.md`.
+
+## 2026-08-15
+
+### CVE requests: three rejected advisories narrowed and resubmitted
+
+GitHub issued CVE-2026-73844 (`GHSA-6f9w`), CVE-2026-73845 (`GHSA-83x6`) and CVE-2026-73846 (`GHSA-78x9`), and rejected three others under CNA rule 4.2.11 — each advisory described more than one independently fixable vulnerability. The requests originate from `GHSA-p5c9`, where the reporters (Gal3m, mrostamipoor) asked for one CVE per finding.
+
+Rather than split published advisories into new public ones, each was **narrowed** to a single defect, with the rest demoted to impact or deployment context:
+
+- `GHSA-3369` — kept the second-order SSRF (destination derived from resource `url` metadata); dropped the `Promise.all` amplification claim, which a concurrency cap fixes independently. CWE-400 removed; vector `S:U/C:L/A:L` (4.7) → `S:C/C:L/A:N` (4.0, still Medium).
+- `GHSA-v3j5` — kept the missing `Origin`/`Host` validation. The MCP spec (Basic/Transports) draws the line for us: origin validation is **MUST**, loopback binding and authentication are **SHOULD**. The latter two stay as deployment context. CWE-306 and CWE-1327 removed.
+- `GHSA-c499` — argued dependency rather than narrowing: one missing neutralization pass at the render boundary produces both the prompt injection and the content spoofing, and no patch fixes one without the other. The remediation section was rewritten as a single control (it previously listed two, which read as two defects). CWE-79 removed.
+
+Also requested the CVE for `GHSA-vqff`, which was in the reporters' list but had neither a CVE nor a rejection — the request had apparently never been submitted.
+
+API notes: `PATCH /repos/{o}/{r}/security-advisories/{ghsa}` accepts `summary`, `description`, `cwe_ids`, `cvss_vector_string` (mutually exclusive with `severity`); `POST .../{ghsa}/cve` re-requests the CVE. There is **no** comments endpoint (404, absent from the OpenAPI description) — advisory comments were posted by replying to the GitHub notification email.
+
+Worth noting for expectations: a CVE is necessary but not sufficient for Dependabot alerts. Only 2 of the repo's advisories are in the global GitHub Advisory Database; CVE-2026-61612 has had a CVE since 2026-06-22 and is still not propagated.
+
 ## 2026-08-06
 
 ### v0.4.118 — pin the fetch path to the validated IP

package/dist/index.js

@@ -660,14 +660,51 @@ async function decodePossiblyCompressed(data, headers) {
     return text;
   }
 }
+function parseIpv6(input) {
+  const v = input.split("%")[0];
+  if (v.includes(":::") || (v.match(/::/g) || []).length > 1) return null;
+  const [head, tail, ...rest] = v.split("::");
+  if (rest.length > 0) return null;
+  const compressed = v.includes("::");
+  const words = [];
+  const pushGroups = (part) => {
+    if (part === "") return true;
+    for (const g of part.split(":")) {
+      if (g.includes(".")) {
+        const m = g.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+        if (!m) return false;
+        const o = m.slice(1).map(Number);
+        if (o.some((n) => n > 255)) return false;
+        words.push(o[0] << 8 | o[1], o[2] << 8 | o[3]);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return false;
+      words.push(parseInt(g, 16));
+    }
+    return true;
+  };
+  if (!pushGroups(head)) return null;
+  const headLen = words.length;
+  if (!pushGroups(compressed ? tail : "")) return null;
+  const tailLen = words.length - headLen;
+  if (!compressed) return words.length === 8 ? words : null;
+  const gap = 8 - headLen - tailLen;
+  if (gap < 1) return null;
+  return [...words.slice(0, headLen), ...Array(gap).fill(0), ...words.slice(headLen)];
+}
 function isBlockedIp(ip) {
   const v = ip.toLowerCase().trim();
   if (v.includes(":")) {
-    if (v === "::1" || v === "::") return true;
-    if (v.startsWith("fc") || v.startsWith("fd")) return true;
-    if (v.startsWith("fe80")) return true;
-    if (v.startsWith("::ffff:")) return true;
-    return false;
+    const w = parseIpv6(v);
+    if (!w) return true;
+    const zeros = (n) => w.slice(0, n).every((x) => x === 0);
+    return zeros(6) || // ::/96 unspecified, loopback, IPv4-compatible
+    zeros(5) && w[5] === 65535 || // ::ffff:0:0/96 IPv4-mapped
+    w[0] === 100 && w[1] === 65435 && (w[2] === 0 && w[3] === 0 && w[4] === 0 && w[5] === 0 || w[2] === 1) || // 64:ff9b::/96 + 64:ff9b:1::/48 NAT64
+    w[0] === 8194 || // 2002::/16 6to4
+    w[0] === 8193 && w[1] === 0 || // 2001::/32 Teredo
+    (w[0] & 65024) === 64512 || // fc00::/7 unique local
+    (w[0] & 65472) === 65152;
   }
   const m = v.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
   if (!m) return false;
@@ -680,6 +717,7 @@ function isBlockedIp(ip) {
   o1 === 169 && o2 === 254 || // 169.254.0.0/16 link-local / cloud metadata
   o1 === 172 && o2 >= 16 && o2 <= 31 || // 172.16.0.0/12 private
   o1 === 192 && o2 === 168 || // 192.168.0.0/16 private
+  o1 === 198 && (o2 === 18 || o2 === 19) || // 198.18.0.0/15 benchmarking
   o1 === 255;
 }
 function validateServerUrl(serverUrl) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aborruso/ckan-mcp-server",
-  "version": "0.4.118",
+  "version": "0.4.119",
   "mcpName": "io.github.aborruso/ckan-mcp-server",
   "description": "MCP server for interacting with CKAN open data portals",
   "repository": {