SSRF via filter bypass due to lax checking on IPs