Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Hono's IP blocking feature can be bypassed when IPv6 addresses are written in different formats. An attacker can use alternative representations of a blocked IP address (like compressed or expanded forms) to bypass security rules meant to deny access.

The ip-restriction middleware in Hono performs incomplete normalization of IPv6 addresses before string comparison against deny/allow rules. Non-canonical IPv6 representations (compressed forms, zero-expanded forms, hex-notation IPv4-mapped addresses) fail to match static rule entries, allowing bypass of IP-based access controls. Attack vector is network-based with no authentication required; impact is circumvention of IP-based security policies.