This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/allura.git
commit 8e96d70099ff566055c1f82f22ea9bae03b80f08 Author: Dave Brondsema <[email protected]> AuthorDate: Wed May 6 12:40:38 2026 -0400 [#8603] NonPrivateUrl checks all host=>IP resolutions not just one --- Allura/allura/lib/validators.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/Allura/allura/lib/validators.py b/Allura/allura/lib/validators.py index e2ceffbba..95e43c219 100644 --- a/Allura/allura/lib/validators.py +++ b/Allura/allura/lib/validators.py @@ -61,13 +61,17 @@ def _convert_to_python(self, value, state): url_components = urlsplit(value) try: - host_ip = socket.gethostbyname(url_components.hostname) + addr_info = socket.getaddrinfo(url_components.hostname, None) except socket.gaierror: raise fev.Invalid("Invalid URL.", value, state) - parse_ip = ip_address(host_ip) - if parse_ip and parse_ip.is_private: - raise fev.Invalid("Invalid URL.", value, state) - self.ip = parse_ip + + for info in addr_info: + host_ip = info[4][0] + parse_ip = ip_address(host_ip) + if parse_ip and parse_ip.is_private: + raise fev.Invalid("Invalid URL.", value, state) + + self.ip = ip_address(addr_info[0][4][0]) return value
