@@ -12,7 +12,7 @@ module SchemaReader =
1212 if uri.IsAbsoluteUri then
1313 schemaPathRaw
1414 elif Path.IsPathRooted schemaPathRaw then
15- Path.Combine( Path.GetPathRoot( resolutionFolder) , schemaPathRaw.Substring( 1 ) )
15+ Path.Combine( Path.GetPathRoot resolutionFolder, schemaPathRaw.Substring 1 )
1616 else
1717 Path.Combine( resolutionFolder, schemaPathRaw)
1818
@@ -30,35 +30,23 @@ module SchemaReader =
3030 let host = url.Host.ToLowerInvariant()
3131
3232 // Block localhost and loopback, and private IP ranges using proper IP address parsing
33- let isIp , ipAddr = System.Net. IPAddress.TryParse( host)
33+ let isIp , ipAddr = IPAddress.TryParse host
3434
3535 if isIp then
3636 // Loopback
37- if
38- System.Net.IPAddress.IsLoopback( ipAddr)
39- || ipAddr.ToString() = " 0.0.0.0"
40- then
37+ if IPAddress.IsLoopback ipAddr || ipAddr.ToString() = " 0.0.0.0" then
4138 failwithf " Cannot fetch schemas from localhost/loopback addresses: %s (set SsrfProtection=false for development)" host
4239 // Private IPv4 ranges
4340 let bytes = ipAddr.GetAddressBytes()
4441
4542 let isPrivate =
46- // 10.0.0.0/8
47- ( ipAddr.AddressFamily = System.Net.Sockets.AddressFamily.InterNetwork
48- && bytes.[ 0 ] = 10 uy)
49- // 172.16.0.0/12
50- || ( ipAddr.AddressFamily = System.Net.Sockets.AddressFamily.InterNetwork
51- && bytes.[ 0 ] = 172 uy
52- && bytes.[ 1 ] >= 16 uy
53- && bytes.[ 1 ] <= 31 uy)
54- // 192.168.0.0/16
55- || ( ipAddr.AddressFamily = System.Net.Sockets.AddressFamily.InterNetwork
56- && bytes.[ 0 ] = 192 uy
57- && bytes.[ 1 ] = 168 uy)
58- // Link-local 169.254.0.0/16
59- || ( ipAddr.AddressFamily = System.Net.Sockets.AddressFamily.InterNetwork
60- && bytes.[ 0 ] = 169 uy
61- && bytes.[ 1 ] = 254 uy)
43+ ipAddr.AddressFamily = Sockets.AddressFamily.InterNetwork
44+ && match bytes with
45+ | [| 10 uy; _; _; _ |] -> true // 10.0.0.0/8
46+ | [| 172 uy; b1; _; _ |] when b1 >= 16 uy && b1 <= 31 uy -> true // 172.16.0.0/12
47+ | [| 192 uy; 168 uy; _; _ |] -> true // 192.168.0.0/16
48+ | [| 169 uy; 254 uy; _; _ |] -> true // Link-local 169.254.0.0/16
49+ | _ -> false
6250
6351 if isPrivate then
6452 failwithf " Cannot fetch schemas from private or link-local IP addresses: %s (set SsrfProtection=false for development)" host
0 commit comments