IPList: update tests and allow an ipv4 mapped ip as input as well

Author: bitterpanda63

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/IPList.java

@@ -18,13 +18,20 @@ public void add(String ipOrCIDR) {
             return; // Don't add if IP is null
         }
         IPAddress ip = new IPAddressString(ipOrCIDR).getAddress();
+        if (ip == null) {
+            return;
+        }
+        // Normalize IPv4-mapped IPv6 addresses to their IPv4 form so matching is symmetric.
+        if (ip.isIPv6() && ip.toIPv6().isIPv4Convertible()) {
+            IPAddress ipv4 = ip.toIPv6().toIPv4();
+            if (ipv4 != null) {
+                ip = ipv4;
+            }
+        }
         if (ipOrCIDR.contains("/")) {
-            // CIDR :
             ip = ip.toPrefixBlock();
         }
-        if (ip != null) {
-            ipAddresses.add(ip);
-        }
+        ipAddresses.add(ip);
     }
 
     public boolean matches(String ip) {

agent_api/src/test/java/helpers/IPListTest.java

@@ -140,4 +140,32 @@ public void testBlocklistStoredIPv4MappedMatchesIPv4Input() {
         blocklist.add("::ffff:23.45.67.89");
         assertTrue(blocklist.matches("::ffff:23.45.67.89"));
     }
+
+    @Test
+    public void testBlocklistAddInvalidIpIgnored() {
+        blocklist.add("notanip");
+        assertEquals(0, blocklist.length());
+        assertFalse(blocklist.matches("192.168.1.1"));
+    }
+
+    @Test
+    public void testBlocklistLengthEmpty() {
+        assertEquals(0, blocklist.length());
+    }
+
+    @Test
+    public void testBlocklistStoredIPv4MappedMatchesPlainIPv4() {
+        blocklist.add("::ffff:23.45.67.89");
+        assertTrue(blocklist.matches("23.45.67.89"));
+        assertTrue(blocklist.matches("::ffff:23.45.67.89"));
+        assertFalse(blocklist.matches("23.45.67.90"));
+    }
+
+    @Test
+    public void testBlocklistStoredIPv4MappedCidrMatchesPlainIPv4() {
+        blocklist.add("::ffff:10.0.0.0/104");
+        assertTrue(blocklist.matches("10.1.2.3"));
+        assertTrue(blocklist.matches("::ffff:10.1.2.3"));
+        assertFalse(blocklist.matches("11.1.2.3"));
+    }
 }