Explicit NO_PROXY /0 CIDR rules fail to bypass HTTP proxy for IP-literal requests
信息泄露 / Information Exposure Through Sent Data / #4114965
该报告还没有中文解读。
原文摘录
摘自原文（3633 字符中的一小部分）
With an HTTP proxy configured, I found that curl sends IPv4 address-literal requests through it with `NO_PROXY=0.0.0.0/0`, and IPv6 address-literal requests through it with `NO_PROXY=::/0`. A zero-bit CIDR prefix should match every address in its family, so those requests should bypass the proxy. A …
原文中的代码
$ /path/to/built/curl -V curl 8.23.0-DEV (Darwin) libcurl/8.23.0-DEV OpenSSL/4.0.3 nghttp2/1.70.0
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @bootherr · 版权归作者与 curl 所有