Summary
_net_within_allowed_networks() raises an uncaught TypeError when a single-IP target and an operator-configured CIDR in settings.allowed_networks use different IP versions. The multi-address-network branch already checks net.version == allowed_net.version, but the single-IP branch calls subnet_of()/overlaps() without that guard.
I found this while auditing IPv6 validation behavior on current main (f3a493b). I could not find an existing issue or PR for the mixed-version crash. This is separate from #204: it does not change which ranges are allowed or blocked, DNS behavior, redirects, or network-policy precedence.
Why this matters
SecuScan explicitly supports IPv4 and IPv6 network policy. An operator who adds an IPv6 CIDR to SECUSCAN_ALLOWED_NETWORKS can cause otherwise valid IPv4 safe-mode target validation to fail with an exception instead of returning a validation result. In an API request path this can surface as a server error.
Reproduction steps
From the repository root:
PYTHONPATH=. python -c 'from backend.secuscan.validation import validate_target; from backend.secuscan.config import settings; settings.allowed_networks=["fc00::/7"]; print(validate_target("127.0.0.1", safe_mode=True))'Actual behavior
TypeError: 127.0.0.1/32 and fc00::/7 are not of the same version
The exception comes from the single-address branch in backend/secuscan/validation.py:
if net.subnet_of(allowed_net) or net.overlaps(allowed_net):
Expected behavior
Mixed IPv4/IPv6 entries should be skipped safely. Validation should continue checking same-version entries and return the normal (is_valid, error_message) tuple without raising.
Scope
Suggested files:
backend/secuscan/validation.pytesting/backend/unit/test_validation.py
Out of scope:
Definition of done
This looks like a focused intermediate backend/security correctness fix. I would like to work on it under GSSoC 2026; please assign it to me if the scope is accepted.
Summary
_net_within_allowed_networks()raises an uncaughtTypeErrorwhen a single-IP target and an operator-configured CIDR insettings.allowed_networksuse different IP versions. The multi-address-network branch already checksnet.version == allowed_net.version, but the single-IP branch callssubnet_of()/overlaps()without that guard.I found this while auditing IPv6 validation behavior on current
main(f3a493b). I could not find an existing issue or PR for the mixed-version crash. This is separate from #204: it does not change which ranges are allowed or blocked, DNS behavior, redirects, or network-policy precedence.Why this matters
SecuScan explicitly supports IPv4 and IPv6 network policy. An operator who adds an IPv6 CIDR to
SECUSCAN_ALLOWED_NETWORKScan cause otherwise valid IPv4 safe-mode target validation to fail with an exception instead of returning a validation result. In an API request path this can surface as a server error.Reproduction steps
From the repository root:
PYTHONPATH=. python -c 'from backend.secuscan.validation import validate_target; from backend.secuscan.config import settings; settings.allowed_networks=["fc00::/7"]; print(validate_target("127.0.0.1", safe_mode=True))'Actual behavior
The exception comes from the single-address branch in
backend/secuscan/validation.py:Expected behavior
Mixed IPv4/IPv6 entries should be skipped safely. Validation should continue checking same-version entries and return the normal
(is_valid, error_message)tuple without raising.Scope
Suggested files:
backend/secuscan/validation.pytesting/backend/unit/test_validation.pyOut of scope:
Definition of done
allowed_networksCIDR comparison pathThis looks like a focused intermediate backend/security correctness fix. I would like to work on it under GSSoC 2026; please assign it to me if the scope is accepted.