Manish Gupta 57b5fb17ad [SECUR-245] fix(security): match reserved /24s exactly and bound the Live request timeout
Addresses review on #9540.

Copilot: the IPv4 blocklist tested only the second octet for blocks that are
actually /24s inside public /16s, so it blackholed real public space. Reviewing
the whole class rather than the one reported case found three instances, not one:

  192.0.0.0/16   -> 192.0.0.0/24 + 192.0.2.0/24   (was blocking 192.0.3.x etc.)
  198.51.0.0/16  -> 198.51.100.0/24               (was blocking 198.51.99.x etc.)
  203.0.0.0/16   -> 203.0.113.0/24                (was blocking 203.0.112.x etc.)

Now matched on the third octet. Verified against the Python guard's is_blocked_ip
(apps/api/plane/utils/ip_address.py) for all 15 boundary cases — TS and Python
verdicts now agree exactly, which is the property the original comment claimed
but did not hold. This was the same implementation-drift failure the helper's own
comment warns about, one commit later.

Tests added in both directions so a future edit cannot silently over-block:
the four reserved /24s must be rejected, and the six adjacent public /24s must
still be allowed. The second assertion is what caught this.

CodeRabbit: requests has no default timeout, so the Live call could pin a Celery
worker indefinitely on a server that accepts the connection then stalls. Adds
LIVE_REQUEST_TIMEOUT = (5, 30) and asserts it is passed. Also asserts a ReadTimeout
degrades duplication rather than failing the task — requests.Timeout subclasses
RequestException, so the existing handler already covers it.

Co-authored-by: Plane AI <noreply@plane.so>
2026-08-27 10:39:32 +05:30
2025-12-05 16:03:51 +05:30
2025-12-05 16:03:51 +05:30
2026-01-27 13:54:22 +05:30
2026-07-28 15:50:53 +05:30
2024-10-03 14:09:01 +05:30



Plane Logo

Modern project management for all teams

WebsiteForumXDocumentation

Plane Screens

Meet Plane, an open-source project management tool to track issues, run sprints cycles, and manage product roadmaps without the chaos of managing the tool itself. 🧘‍♀️

Plane is evolving every day. Your suggestions, ideas, and reported bugs help us immensely. Do not hesitate to join in the conversation on Forum or raise a GitHub issue. We read everything and respond to most.

🚀 Installation

Getting started with Plane is simple. Choose the setup that works best for you:

  • Plane Cloud Sign up for a free account on Plane Cloud—it's the fastest way to get up and running without worrying about infrastructure.

  • Self-host Plane Prefer full control over your data and infrastructure? Install and run Plane on your own servers. Follow our detailed deployment guides to get started.

Installation methods Docs link
Docker Docker
Kubernetes Kubernetes
Managed hosting Deploy with Zenith

Instance admins can configure instance settings with God mode.

🌟 Features

  • Work Items Efficiently create and manage tasks with a robust rich text editor that supports file uploads. Enhance organization and tracking by adding sub-properties and referencing related issues.

  • Cycles Maintain your teams momentum with Cycles. Track progress effortlessly using burn-down charts and other insightful tools.

  • Modules Simplify complex projects by dividing them into smaller, manageable modules.

  • Views Customize your workflow by creating filters to display only the most relevant issues. Save and share these views with ease.

  • Pages Capture and organize ideas using Plane Pages, complete with AI capabilities and a rich text editor. Format text, insert images, add hyperlinks, or convert your notes into actionable items.

  • Analytics Access real-time insights across all your Plane data. Visualize trends, remove blockers, and keep your projects moving forward.

🛠️ Local development

See CONTRIBUTING

⚙️ Built with

React Router Django Node JS

📸 Screenshots

Plane Views

Plane Cycles and Modules

Plane Analytics

Plane Pages

📝 Documentation

Explore Plane's product documentation and developer documentation to learn about features, setup, and usage.

❤️ Community

Join the Plane community on GitHub Discussions and our Forum. We follow a Code of conduct in all our community channels.

Feel free to ask questions, report bugs, participate in discussions, share ideas, request features, or showcase your projects. Wed love to hear from you!

🛡️ Security

If you discover a security vulnerability in Plane, please report it responsibly instead of opening a public issue. We take all legitimate reports seriously and will investigate them promptly. See Security policy for more info.

To disclose any security issues, please email us at security@plane.so.

🤝 Contributing

There are many ways you can contribute to Plane:

Please read CONTRIBUTING.md for details on the process for submitting pull requests to us.

Repo activity

Plane Repo Activity

We couldn't have done this without you.

License

This project is licensed under the GNU Affero General Public License v3.0.

Description
🔥 🔥 🔥 Open Source JIRA, Linear, Monday, and Asana Alternative. Plane helps you track your issues, epics, and cycles the easiest way on the planet. plane.so
Readme 474 MiB
Languages
TypeScript 69.6%
Python 26.6%
HTML 2.4%
JavaScript 0.6%
Shell 0.5%
Other 0.3%