Better handles reserved IPv6 addresses in WebFetchApi::isFetchSafe()

Author: Sesquipedalian

Sources/IP.php

@@ -100,8 +100,15 @@ public function __construct(self|string|null $ip)
 		}
 		// Is it in a valid IPv6 string?
 		elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false) {
-			// Pack and unpack to ensure it is in standard form.
-			$this->ip = inet_ntop(inet_pton($ip));
+			if (str_starts_with($ip, '64:ff9b::')) {
+				// Workaround for a PHP bug where NAT64 addresses aren't handled
+				// properly when the last 32 bits are in IPv6 notation instead
+				// of IPv4 notation. See https://en.wikipedia.org/wiki/NAT64.
+				$this->ip = '64:ff9b::' . inet_ntop(hex2bin(substr(bin2hex(inet_pton($ip)), -8)));
+			} else {
+				// Pack and unpack to ensure it is in standard form.
+				$this->ip = inet_ntop(inet_pton($ip));
+			}
 		}
 		// It's either in binary form or it's invalid.
 		else {

Sources/Url.php

@@ -499,7 +499,7 @@ public function proxied(): self
 			// Don't proxy URLs whose hosts are private or reserved IP addresses.
 			|| (
 				filter_var($proxied->host, FILTER_VALIDATE_IP) !== false
-				&& filter_var($proxied->host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false
+				&& filter_var($proxied->host, FILTER_VALIDATE_IP, FILTER_FLAG_GLOBAL_RANGE) === false
 			)
 		) {
 			return $proxied;

Sources/WebFetch/WebFetchApi.php

@@ -17,6 +17,7 @@
 
 use SMF\Lang;
 use SMF\Url;
+use SMF\IP;
 
 /**
  * Class SearchApi
@@ -256,13 +257,7 @@ public static function isFetchSafe(Url $url, array $allowed_schemes = []): bool
 			// Couldn't resolve to anything: refuse rather than guess.
 			$ips === []
 			// EVERY resolved address must be a global, public, unicast IP.
-			|| $ips !== filter_var_array(
-				$ips,
-				[
-					'filter' => FILTER_VALIDATE_IP,
-					'flags' => FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE,
-				],
-			)
+			|| $ips !== array_filter($ips, fn($ip) => IP::create($ip)->isValid(FILTER_FLAG_GLOBAL_RANGE)),
 		) {
 			self::$safe_hosts[$url->host] = false;
 		}