C#: Add experimental SSRF IPv6-transition incomplete-guard query (CWE-918/CWE-1389) by tonghuaroot · Pull Request #148 · GitHubSecurityLab/CodeQL-Community-Packs

tonghuaroot · 2026-06-12T08:33:22Z

Summary

Adds a new experimental C# query, githubsecuritylab/cs/ssrf-ipv6-transition-incomplete-guard, that flags SSRF host-validation guards which reject private / loopback / cloud-metadata IPv4 ranges but never unwrap IPv6-transition representations.

When a guard inspects only the dotted-quad IPv4 form, an attacker can wrap an internal IPv4 address in a transition literal so the validator classifies the host as public while the OS still routes the connection to the embedded internal endpoint. The affected forms are:

IPv4-mapped IPv6 — ::ffff:169.254.169.254
NAT64 — 64:ff9b::a9fe:a9fe
6to4 — 2002::

A URL such as http://[::ffff:169.254.169.254]/ passes a dotted-quad denylist unchanged while still reaching the internal address. Calling IPAddress.MapToIPv4() / testing IPAddress.IsIPv4MappedToIPv6 only canonicalizes the ::ffff:0:0/96 prefix, so NAT64 / 6to4 / IPv4-compatible forms remain live (CWE-918 / CWE-1389).

Origin

This was originally proposed in github/codeql#21964. @michaelnebel suggested moving it to the Community Packs rather than landing it as an experimental query in github/codeql, so this PR ports it here.

csharp/src/security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql — the query (@kind problem, import csharp only, autoformatted)
csharp/src/security/CWE-918/SsrfIpv6TransitionIncompleteGuard.qhelp — query help
csharp/src/security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuard{Bad,Good}.cs — qhelp examples
csharp/test/security/CWE-918/SsrfIpv6TransitionIncompleteGuard/ — unit test (.cs / .qlref / .expected / options)

Adapted to Community Packs conventions: @id namespace githubsecuritylab/cs/..., query under csharp/src/security/CWE-918/, test under csharp/test/security/CWE-918/ with a ${testdir}/.../codeql/... stub options path matching the existing tests. The github/codeql-specific change-note and integration-test (not_included_in_qls.expected) files were dropped.

Verification

Verified locally with CodeQL CLI 2.25.6:

codeql query compile csharp/src/security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql — compiles clean, no warnings.
codeql query format — idempotent (autoformatted).
codeql test run csharp/test/security/CWE-918/SsrfIpv6TransitionIncompleteGuard — passes (2 expected true positives flagged, 4 transition-aware / out-of-scope callables correctly suppressed).

Adds githubsecuritylab/cs/ssrf-ipv6-transition-incomplete-guard, which flags SSRF host-validation guards that reject private/loopback IPv4 ranges but never unwrap IPv6-transition forms (IPv4-mapped ::ffff:, NAT64 64:ff9b::, 6to4 2002::). Such guards can be bypassed by wrapping an internal IPv4 address in a transition literal, so the validator classifies the host as public while the OS still routes to the internal endpoint (CWE-918 / CWE-1389). Includes qhelp, good/bad examples, and a unit test.

Copilot

Pull request overview

Adds an experimental C# CodeQL query to detect SSRF host-validation guards that attempt to block internal IPv4 addresses but fail to unwrap IPv6-transition representations (IPv4-mapped IPv6, NAT64, 6to4), plus accompanying qhelp, examples, and a unit test.

Changes:

Introduces githubsecuritylab/cs/ssrf-ipv6-transition-incomplete-guard query under csharp/src/security/CWE-918/.
Adds qhelp documentation and Good/Bad examples illustrating the vulnerability and mitigations.
Adds a new unit test suite (.cs / .qlref / .expected / options) for the query.

Show a summary per file

File	Description
csharp/src/security/CWE-918/SsrfIpv6TransitionIncompleteGuard.ql	New experimental query detecting IPv6-transition unwrap gaps in SSRF host guards.
csharp/src/security/CWE-918/SsrfIpv6TransitionIncompleteGuard.qhelp	Query help text describing risk, recommendation, and examples.
csharp/src/security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuardBad.cs	“Bad” example demonstrating a bypassable host guard.
csharp/src/security/CWE-918/examples/SsrfIpv6TransitionIncompleteGuardGood.cs	“Good” example demonstrating transition-aware normalization before checks.
csharp/test/security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.cs	Test code with in-scope and suppressed guard patterns.
csharp/test/security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.qlref	Test reference to the new query.
csharp/test/security/CWE-918/SsrfIpv6TransitionIncompleteGuard/SsrfIpv6TransitionIncompleteGuard.expected	Expected results for the new query test.
csharp/test/security/CWE-918/SsrfIpv6TransitionIncompleteGuard/options	Extractor options for compiling the test with stubs.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 8/8 changed files
Comments generated: 4

+predicate hasRfc1918Literal(Callable c) {
+  exists(StringLiteral s | s.getEnclosingCallable() = c |
+    s.getValue()
+        .regexpMatch("(?i).*(127\\.0\\.0\\.1|169\\.254\\.169\\.254|10\\.|192\\.168|172\\.1[6-9]|::1|fc00|fd00|metadata\\.google).*")


+ * Holds if `c` contains a hand-written RFC 1918, loopback or cloud-metadata IPv4 literal
+ * used as a denylist entry.


+    {
+        byte[] b = addr.GetAddressBytes();
+        // NAT64 well-known prefix 64:ff9b::/96 -> last 4 bytes are the embedded IPv4.
+        if (b.Length == 16 && b[0] == 0x00 && b[1] == 0x64 && b[2] == 0xff && b[3] == 0x9b)


+        byte[] b = addr.GetAddressBytes();
+        return b.Length == 4
+            && (b[0] == 127 || b[0] == 10 || (b[0] == 169 && b[1] == 254)
+                || (b[0] == 192 && b[1] == 168) || (b[0] == 172 && b[1] == 16));


…te guard-literal comment, tighter NAT64 WKP example

tonghuaroot · 2026-06-19T14:44:12Z

Thanks for the review — all four points addressed in c2bb181:

Full RFC1918 172.16/12 (172.16–172.31): the private-IPv4 matcher regex went from 172\.1[6-9] to 172\.(1[6-9]|2[0-9]|3[01]), so the query now recognizes guards covering the whole /12 block, not just the first four /16s. Added a 172.20/172.31 BAD test case to lock in the recall.
Accurate predicate comment: hasRfc1918Literal's doc now states it matches not only IPv4 denylist forms but also the IPv6 loopback/ULA fragments ::1/fc00/fd00 and the metadata.google hostname fragment.
Tighter NAT64 WKP in the GOOD example: the 64:ff9b::/96 check now also requires bytes 4..11 == 0, so addresses that merely start with 64:ff9b but carry non-zero middle bytes aren't mistakenly unwrapped.
Full /12 in the GOOD example's private-range check: b[1] == 16 → b[1] >= 16 && b[1] <= 31, so readers don't copy an incomplete guard.

codeql query compile --warnings=error clean, codeql test run passes, format idempotent. .expected gained one entry (the new 172.20/.31 true-positive) by design.

kevinbackhouse · 2026-06-19T17:05:45Z

+ * Holds if `c` contains a hand-written denylist literal: an RFC 1918 / loopback /
+ * link-local-metadata IPv4 form (`127.0.0.1`, `169.254.169.254`, `10.`, `192.168`, the full
+ * `172.16.0.0/12` range `172.16`-`172.31`), an IPv6 loopback or ULA fragment (`::1`, `fc00`,
+ * `fd00`), or the cloud-metadata hostname fragment `metadata.google`.


What is metadata.google and why is it included as a special case?

Kwstubbs · 2026-06-22T21:28:26Z

+ * literal, or a NAT64 / 6to4 / extract-embedded-IPv4 helper, means every transition family
+ * is accounted for rather than the `::ffff:0:0/96` prefix alone.
+ */
+predicate hasTransitionUnwrap(Callable c) {


The safe logic here seems too broad. The current hasTransitionUnwrap predicate may incorrectly suppress alerts just because it saw ::ffff: but doesn't handle 2002:. Is this intentional?

Kwstubbs · 2026-06-22T21:48:07Z

+predicate hasRfc1918Literal(Callable c) {
+  exists(StringLiteral s | s.getEnclosingCallable() = c |
+    s.getValue()
+        .regexpMatch("(?i).*(127\\.0\\.0\\.1|169\\.254\\.169\\.254|10\\.|192\\.168|172\\.(1[6-9]|2[0-9]|3[01])|::1|fc00|fd00|metadata\\.google).*")


This query seems to be missing some common IP addresses, including but not limited to:
127.0.0.0/8, not just 127.0.0.1
169.254.0.0/16, not just 169.254.169.254
localhost
0.0.0.0

Kwstubbs · 2026-06-22T21:54:24Z

+        while still reaching the internal address. Calling
+        <code>IPAddress.MapToIPv4()</code> or testing
+        <code>IPAddress.IsIPv4MappedToIPv6</code> only canonicalizes the
+        <code>::ffff:0:0/96</code> prefix; NAT64, 6to4 and IPv4-compatible forms remain


IPv4-compatible IPv6 addresses (::/96) are deprecated. Please remove them from the PR contents. If you wish to include them, add to hasTransitionUnwrap

Kwstubbs · 2026-06-22T22:03:59Z

@tonghuaroot Thank you for the contribution. Just curious, what was the purpose of you creating this query. Were you able to use it to find security issues?

tonghuaroot mentioned this pull request Jun 12, 2026

Add experimental C# query: SSRF host guard missing IPv6-transition unwrap (CWE-918/CWE-1389) github/codeql#21964

Open

kevinbackhouse requested a review from Copilot June 19, 2026 11:30

Copilot started reviewing on behalf of kevinbackhouse June 19, 2026 11:30 View session

Copilot AI reviewed Jun 19, 2026

View reviewed changes

C#: address review feedback — full RFC1918 172.16/12 coverage, accura…

c2bb181

…te guard-literal comment, tighter NAT64 WKP example

kevinbackhouse self-assigned this Jun 19, 2026

kevinbackhouse reviewed Jun 19, 2026

View reviewed changes

Kwstubbs self-requested a review June 19, 2026 17:23

Kwstubbs reviewed Jun 22, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

C#: Add experimental SSRF IPv6-transition incomplete-guard query (CWE-918/CWE-1389)#148

C#: Add experimental SSRF IPv6-transition incomplete-guard query (CWE-918/CWE-1389)#148
tonghuaroot wants to merge 2 commits into
GitHubSecurityLab:mainfrom
tonghuaroot:experimental-ssrf-ipv6-transition-csharp

tonghuaroot commented Jun 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

tonghuaroot commented Jun 19, 2026

Uh oh!

kevinbackhouse Jun 19, 2026

Uh oh!

Kwstubbs Jun 22, 2026

Uh oh!

Kwstubbs Jun 22, 2026

Uh oh!

Kwstubbs Jun 22, 2026

Uh oh!

Kwstubbs commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		* Holds if `c` contains a hand-written RFC 1918, loopback or cloud-metadata IPv4 literal
		* used as a denylist entry.

Conversation

tonghuaroot commented Jun 12, 2026

Summary

Origin

Contents

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

tonghuaroot commented Jun 19, 2026

Uh oh!

kevinbackhouse Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

Kwstubbs Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Kwstubbs Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Kwstubbs Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Kwstubbs commented Jun 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants