Bug 228826

Summary:

Reject non-IPv4 hostnames that end in numbers

Product:

WebKit

Reporter:

Anne van Kesteren <annevk>

Component:

DOM

Assignee:

Alex Christensen <achristensen>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

achristensen, benjamin, cdumez, clopez, cmarcelo, ews-watchlist, thorton, webkit-bug-importer, youennf

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none
Patch	none
Patch	ews-feeder: commit-queue-
Patch	none
Patch	none
Patch	none

Anne van Kesteren

Reported 2021-08-05 07:30:07 PDT

See https://github.com/whatwg/url/pull/619 and https://github.com/web-platform-tests/wpt/pull/29666.

Attachments
Patch (60.28 KB, patch) 2021-08-06 17:42 PDT, Alex Christensen	no flags	Details Formatted Diff Diff
Patch (61.84 KB, patch) 2021-08-09 09:54 PDT, Alex Christensen	no flags	Details Formatted Diff Diff
Patch (65.45 KB, patch) 2021-08-09 10:10 PDT, Alex Christensen	ews-feeder: commit-queue-	Details Formatted Diff Diff
Patch (65.57 KB, patch) 2021-08-09 11:41 PDT, Alex Christensen	no flags	Details Formatted Diff Diff
Patch (68.28 KB, patch) 2021-08-09 12:46 PDT, Alex Christensen	no flags	Details Formatted Diff Diff
Patch (70.06 KB, patch) 2021-08-31 15:51 PDT, Alex Christensen	no flags	Details Formatted Diff Diff
Show Obsolete (5) View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2021-08-06 10:47:19 PDT

So it I have a website at http://site0.webkit.org, and configured a DNS search domain webkit.org on my machine, the browser should prevent loading site0?..

Alex Christensen

Comment 2 2021-08-06 12:13:38 PDT

No, I believe this only prevents URLs like http://webkit.org.001/ from parsing, with only digits or hex numbers after the last dot.

Alex Christensen

Comment 3 2021-08-06 17:42:18 PDT

Created attachment 435104 [details] Patch

EWS Watchlist

Comment 4 2021-08-06 17:43:23 PDT

This patch modifies the imported WPT tests. Please ensure that any changes on the tests (not coming from a WPT import) are exported to WPT. Please see https://trac.webkit.org/wiki/WPTExportProcess

Alex Christensen

Comment 5 2021-08-06 17:52:40 PDT

I added some tests to WPT here: https://github.com/web-platform-tests/wpt/pull/29936

Alex Christensen

Comment 6 2021-08-06 17:53:42 PDT

Adding (later) to title to remind myself to revisit this after our next branch.

Alex Christensen

Comment 7 2021-08-07 16:50:55 PDT

Other tests should include these: https://example.037777777777/ https://example.040000000000/ https://example.0x100000000/ https://example.0xffffffff/ https://example.4294967295/ https://example.4294967296/ https://example.4x4/

Alex Christensen

Comment 8 2021-08-09 09:54:53 PDT

Created attachment 435187 [details] Patch