fix(no_proxy): canonicalise IPv4 shorthand/octal/hex in shouldBypassProxy

🏄

Summary

shouldBypassProxy compared NO_PROXY entries against the request hostname
as raw strings. Node's URL parser, however, accepts IPv4 in shorthand
(127.1), octal (0177.0.0.1), and hex (0x7f.0.0.1) form and silently
canonicalises it to dotted-decimal before the hostname reaches the helper.
That asymmetry let a NO_PROXY entry like 127.1 fail to match a request to
http://127.0.0.1/, and — more importantly — let an entry written in
canonical form silently fail to match a request URL whose host was written
in shorthand/octal/hex. The latter is a parser-differential bypass:
NO_PROXY=127.0.0.1 is supposed to keep loopback traffic off the proxy,
but a request to http://0177.0.0.1/ (Node-canonicalised to 127.0.0.1)
did not match the canonical entry and so went through the proxy.

This change adds a normalizeIPAddress helper that mirrors Node's per-part
parsing (hex prefix → base 16, 0-prefixed multi-digit → base 8, otherwise
base 10) and routes the result through the existing normalizeNoProxyHost
so both sides of the comparison see the same canonical dotted-decimal form.
The helper is fail-safe: out-of-range octets, invalid hex digits, 1-part
inputs (which Node treats as a 32-bit integer, e.g. 127 → 0.0.0.127),
and 5+ parts return the input unchanged so the policy falls through to
non-bypass.

Closes the NO_PROXY parser-differential gap that v1.18.0's URL-and-request
hardening pass (#11000) did not cover.

Maintainers: this may be worth tracking as a follow-up advisory to
GHSA-pjwm-pj3p-43mv / CVE-2025-62718 (the prior IPv4-mapped-IPv6 fix in
this same helper). Happy to revise wording or coordinate a CVE/GHSA
assignment if so — flagging here so the work can route whichever way
you prefer.

Changes

• lib/helpers/shouldBypassProxy.js: add parseIPv4Octet and
  normalizeIPAddress; route normalizeNoProxyHost through the helper
  before falling back to the existing IPv4-mapped IPv6 unmap.
• tests/unit/helpers/shouldBypassProxy.test.js: 12 new cases in a new
  describe('IPv4 shorthand / octal / hex normalization', …) block,
  covering each shorthand/octal/hex form on both sides of the comparison
  and three fail-safe cases (out-of-range, invalid hex digit, 1-part).
• PRE_RELEASE_CHANGELOG.md: one-line entry under Bug Fixes per the
  repo's contributor guide (which prefers the pre-release changelog over
  CHANGELOG.md for unreleased changes).

Test plan

• npx vitest run tests/unit/helpers/shouldBypassProxy.test.js —
  52/52 pass (40 pre-existing + 12 new).
• npm run test:vitest — full suite green.

Checklist

• Tests added (12 new cases appended to the existing suite).
• No public API change; no index.d.ts/index.d.cts change needed.
• No breaking changes.
• No new runtime dependencies.
• No changes to package-lock.json (the existing lockfile is
  consistent with the existing package.json after a clean
  npm ci).

Summary by cubic

Fixes NO_PROXY mismatches by normalizing IPv4 shorthand, octal, and hex hostnames in shouldBypassProxy to dotted-decimal to match Node’s URL parser. Also adds safe tail expansion for shorthand forms and rejects invalid zero-prefixed decimals and out-of-range tails.

Description

• Summary of changes
  • Added normalizeIPAddress and parseIPv4Octet to canonicalize IPv4 shorthand, octal (0177.0.0.1), and hex (0x7f.0.0.1) to dotted-decimal.
  • Expanded shorthand-tail parsing: parse tail as a full IPv4 number (hex/octal/decimal) and pack low-byte-right; e.g. 127.65535 → 127.0.255.255.
  • Fail-safe rejections: invalid zero-prefixed decimals (e.g. 08), out-of-range octets/tails, and 1-part or 5+ parts.
  • Routed normalizeNoProxyHost through the new helper before IPv4-mapped-IPv6 unmapping.
  • Updated pre-release changelog; clarified a test comment and added an inline URL parse assertion.
• Reasoning
  • Aligns NO_PROXY comparison with Node host canonicalization to prevent false negatives and proxy-bypass via parser differentials.
• Additional context
  • No public API changes or new dependencies.

Docs

Add a note in /docs/ that NO_PROXY IPv4 entries are normalized to dotted-decimal and match shorthand, octal, and hex forms accepted by Node’s parser. Include brief examples for multi-byte tail expansion and list fail-safes (invalid digits, out-of-range tails, single-part inputs).

Testing

• Added 21 unit tests in tests/unit/helpers/shouldBypassProxy.test.js covering:
  • Cross-form matches (entry ↔ request) for shorthand, octal, hex.
  • Multi-byte tail expansion in 2- and 3-part inputs (decimal/hex/octal).
  • Fail-safes (out-of-range octet/tail, invalid hex digit, invalid zero-prefixed decimals, single-part inputs).
  • Port preservation across normalization and an inline URL hostname assertion.
• Full suite passes.

Semantic version impact

Patch: bug fix with no API changes.

^{Written for commit 00ab59b. Summary will update on new commits.}