@node9/proxy 2.9.2 → 2.9.3

package/dist/cli.js

@@ -2063,7 +2063,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2075,7 +2075,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2091,7 +2091,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
     return {
       ...m,
@@ -3205,7 +3205,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_crypto3, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto4, IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4360,9 +4360,15 @@ var init_dist = __esm({
       // AWS ECS task role
       "168.63.129.16",
       // Azure WireServer
-      "fd00:ec2::254"
+      "fd00:ec2::254",
       // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
     ]);
+    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
     METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
     v4Octets = (a) => {
       const p = a.split(".");
@@ -4372,7 +4378,7 @@ var init_dist = __esm({
       metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
       "link-local": "a link-local address",
       multicast: "a multicast address",
-      unspecified: "the unspecified address",
+      unspecified: "the unspecified address, which reaches this host",
       cgnat: "a carrier-grade NAT address",
       private: "a loopback or private address"
     };

package/dist/cli.mjs

@@ -2074,7 +2074,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -2086,7 +2086,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -2102,7 +2102,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt2.has(m.normalized)) continue;
     return {
       ...m,
@@ -3216,7 +3216,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var IBAN_LENGTH, B58, B58_INDEX, XPRV_VERSIONS, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, SSRF_MAX_HOST, METADATA_ADDRESSES, STRICT_TIERS, METADATA_HOSTNAMES, v4Octets, TIER_REASON, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC16_RE, PII_CC15_RE, PII_IBAN_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, CANARY_MIN_LENGTH, MAX_TEXT, MAX_DEPTH2, MAX_JSON_PARSE, URL_DEPTH, B64_DEPTH, MIN_SEGMENT, SEPARATORS, stripSeparators, looksText, CANARY_DECODERS, VIEWS, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4364,9 +4364,15 @@ var init_dist = __esm({
       // AWS ECS task role
       "168.63.129.16",
       // Azure WireServer
-      "fd00:ec2::254"
+      "fd00:ec2::254",
       // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
     ]);
+    STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
     METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
     v4Octets = (a) => {
       const p = a.split(".");
@@ -4376,7 +4382,7 @@ var init_dist = __esm({
       metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
       "link-local": "a link-local address",
       multicast: "a multicast address",
-      unspecified: "the unspecified address",
+      unspecified: "the unspecified address, which reaches this host",
       cgnat: "a carrier-grade NAT address",
       private: "a loopback or private address"
     };

package/dist/dashboard.mjs

@@ -856,7 +856,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -868,7 +868,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -1759,8 +1759,13 @@ var init_dist = __esm({
       // AWS ECS task role
       "168.63.129.16",
       // Azure WireServer
-      "fd00:ec2::254"
+      "fd00:ec2::254",
       // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+      // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+      // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+      // live credential endpoint. It has to be named here, above the range check,
+      // and it is the reason relaxing cgnat is safe.
+      "100.100.100.200"
     ]);
     METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
     v4Octets = (a) => {

package/dist/index.js

@@ -3117,9 +3117,15 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -3142,7 +3148,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -3154,7 +3160,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -3167,7 +3173,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -3178,7 +3184,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
     return {
       ...m,

package/dist/index.mjs

@@ -3087,9 +3087,15 @@ var METADATA_ADDRESSES = /* @__PURE__ */ new Set([
   // AWS ECS task role
   "168.63.129.16",
   // Azure WireServer
-  "fd00:ec2::254"
+  "fd00:ec2::254",
   // AWS IMDS over IPv6 (inside fc00::/7, which is NOT a tier)
+  // Alibaba Cloud IMDS. It sits INSIDE 100.64/10, so before this line it was
+  // classified as cgnat and therefore exemptable: one ssrfAllow entry opened a
+  // live credential endpoint. It has to be named here, above the range check,
+  // and it is the reason relaxing cgnat is safe.
+  "100.100.100.200"
 ]);
+var STRICT_TIERS = /* @__PURE__ */ new Set(["private", "unspecified", "cgnat"]);
 var METADATA_HOSTNAMES = /* @__PURE__ */ new Set(["metadata.google.internal", "metadata.goog", "metadata"]);
 var v4Octets = (a) => {
   const p = a.split(".");
@@ -3112,7 +3118,7 @@ function classifySsrf(host) {
     if (METADATA_ADDRESSES.has(ip)) return hit("metadata", false);
     const o = v4Octets(ip);
     if (o) {
-      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", false);
+      if (o[0] === 0 && o[1] === 0 && o[2] === 0 && o[3] === 0) return hit("unspecified", true);
       if (o[0] === 169 && o[1] === 254) return hit("link-local", false);
       if (o[0] >= 224 && o[0] <= 239) return hit("multicast", false);
       if (o[0] === 100 && o[1] >= 64 && o[1] <= 127) return hit("cgnat", true);
@@ -3124,7 +3130,7 @@ function classifySsrf(host) {
     }
     const g = expandIpv6(ip);
     if (!g) return null;
-    if (g.every((x) => x === 0)) return hit("unspecified", false);
+    if (g.every((x) => x === 0)) return hit("unspecified", true);
     if ((g[0] & 65472) === 65152) return hit("link-local", false);
     if ((g[0] & 65280) === 65280) return hit("multicast", false);
     if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1) return hit("private", true);
@@ -3137,7 +3143,7 @@ var TIER_REASON = {
   metadata: "a cloud instance-metadata endpoint, the classic credential-theft target",
   "link-local": "a link-local address",
   multicast: "a multicast address",
-  unspecified: "the unspecified address",
+  unspecified: "the unspecified address, which reaches this host",
   cgnat: "a carrier-grade NAT address",
   private: "a loopback or private address"
 };
@@ -3148,7 +3154,7 @@ function ssrfFloor(tokens, opts = {}) {
   for (const { token, binary } of tokens) {
     const m = classifySsrf(token);
     if (!m) continue;
-    if (m.tier === "private" && !opts.ssrfStrict) continue;
+    if (STRICT_TIERS.has(m.tier) && !opts.ssrfStrict) continue;
     if (m.overridable && m.normalized && exempt.has(m.normalized)) continue;
     return {
       ...m,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.9.2",
+  "version": "2.9.3",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",