Sahana2524 opened a new pull request, #417:
URL: https://github.com/apache/commons-net/pull/417
`SubnetUtils6` turns its string input into bytes with
`InetAddress.getByName()`, which falls back to a DNS lookup for anything that
is not an IP literal. `SubnetInfo.isInRange(String)` and the
`SubnetUtils6(String)` constructors are documented to take an IPv6 address, but
today they also accept host names:
- `new
SubnetUtils6("2001:db8::/32").getInfo().isInRange("attacker.example")` returns
`true` when that name has an AAAA record in `2001:db8::/32`. If an application
checks a client-supplied value against an allowlist (for example a
forwarded-for header), sending a name the client controls passes the check.
- Every such call also makes the server resolve a name chosen by the client,
and `""` is mapped to the loopback address.
The IPv4 `SubnetUtils` already parses with a regex and never resolves names,
so this brings `SubnetUtils6` in line with it. The new check only lets through
strings shaped like an IPv6 literal (hex digits and a colon first, optional
brackets and `%scope`). For those, `getByName()` always parses the literal and
never does a lookup. Bracketed and scoped literals keep working.
Repro (JDK 18+ resolver SPI mapping `attacker.example` to `2001:db8::5`),
before and after:
```
isInRange("attacker.example") = true # [DNS lookup] attacker.example
isInRange("attacker.example") -> IAE: Could not parse [attacker.example] -
not an IPv6 address
```
About the test: `testHostNameIsNotResolved` always passes with the fix
because no lookup happens. Without the fix it fails only where one of the names
resolves to IPv6. That happens with `ip6-localhost` on typical Linux hosts, or
with `-DargLine=-Djava.net.preferIPv6Addresses=true`, which is how I confirmed
it locally. This touches the same `toBytes()` helper as #412 (IPv4-mapped
literals). The two changes are independent, and mapped literals like
`::ffff:192.0.2.1` still match the new pattern.
Thanks for your contribution to [Apache
Commons](https://commons.apache.org/)! Your help is appreciated!
Before you push a pull request, review this list:
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
- [x] Read the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) if you use
Artificial Intelligence (AI).
- [x] I used AI to create any part of, or all of, this pull request. Which
AI tool was used to create this pull request, and to what extent did it
contribute?
Claude Code (Anthropic) found this issue and drafted the fix, the test and
this description. I reviewed all of it before submitting.
- [x] Run a successful build using the default
[Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command
line by itself.
- [x] Write unit tests that match behavioral changes, where the tests fail
if the changes to the runtime are not applied. This may not always be possible,
but it is a best practice.
- [x] Write a pull request description that is detailed enough to understand
what the pull request does, how, and why.
- [x] Each commit in the pull request should have a meaningful subject line
and body. Note that a maintainer may squash commits during the merge process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
