net: reject non-address SocketAddress.parse input - #64832
Conversation
Signed-off-by: Guilherme Araújo <arauujogui@gmail.com>
|
Review requested:
|
nodejs-github-bot
added
needs-ci
There was a problem hiding this comment.
This would make the port issue much simpler with this additional validation. If the string ends in /:(\d+)$/, then it can just be sliced off, and if the rest of the string gets parsed as a valid hostname by URLParse then the port can be obtained from the digit string with NumberParseInt.
| // The URL parser below silently discards anything that is not the host or | ||
| // port, and percent-decodes and IDNA-maps what remains, so restrict the | ||
| // input to characters that can appear in an address and port first. | ||
| if (RegExpPrototypeExec(kValidInput, input) === null) return; |
There was a problem hiding this comment.
The only downside is that this matches hostname-like strings like cabbage.ca, which will be parsed by URLParse and returned from this method as "IPv4 addresses".
Should probably also check after parsing that url.hostname passes isIPv4/isIPv6 as appropriate.
There was a problem hiding this comment.
Or indeed could just validate url.hostname with the simpler /^\[|\.\d+$/ since anything matching those that's not a valid IPv4/IPv6 address would already have been rejected by URLParse.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #64832 +/- ##
==========================================
- Coverage 91.90% 90.17% -1.73%
==========================================
Files 383 746 +363
Lines 170878 242774 +71896
Branches 26181 45746 +19565
==========================================
+ Hits 157051 218931 +61880
- Misses 13527 15341 +1814
- Partials 300 8502 +8202
🚀 New features to boost your workflow:
|
| * Returns: {net.SocketAddress} Returns a `SocketAddress` if parsing was successful. | ||
| Otherwise returns `undefined`. | ||
|
|
||
| The `input` may contain only hexadecimal digits, `x`, `.`, `:`, `[`, and `]`. |
There was a problem hiding this comment.
I would personally suggest something like
The address portion of `input` must be a valid IPv4 or IPv6 hostname as recognized by the [WHATWG URL parser][]`.
No description provided.