imbajin commented on code in PR #3291:
URL: https://github.com/apache/hugegraph/pull/3291#discussion_r4225686596
##########
hugegraph-store/hg-store-core/src/main/java/org/apache/hugegraph/store/util/IpUtil.java:
##########
@@ -94,8 +113,34 @@ public static String getNearestAddress(String raftAddress) {
} catch (SocketException e) {
log.error("getIpAddress, get ip failed, {}", e.getMessage());
} catch (Exception e) {
- log.error("getRaftAddress, got exception, {}", e.getMessage());
+ log.error("getNearestAddress, got exception, {}", e.getMessage());
}
return raftAddress;
}
+
+ /**
+ * A dotted IPv4 literal is four numeric octets. Hostnames must not be
+ * parsed as addresses; {@code Integer.parseInt} on a DNS label is not a
+ * signal to log or to replace the configured host.
+ */
+ private static boolean isDottedIpv4(String host) {
+ String[] parts = host.split("\\.", -1);
+ if (parts.length != 4) {
+ return false;
+ }
+ for (String part : parts) {
+ if (part.isEmpty() || part.length() > 3) {
+ return false;
+ }
+ for (int i = 0; i < part.length(); i++) {
+ if (!Character.isDigit(part.charAt(i))) {
Review Comment:
🧹 Blocking: no. Summary: `Character.isDigit` and `Integer.parseInt` both
accept Unicode decimal digits, so a Unicode IDN hostname such as `Ù¡.Ù¢.Ù£.Ù¤:8510`
passes this check and is rewritten to a local fallback instead of being
returned unchanged. Please restrict octets to ASCII `0`–`9` or use a strict
IPv4 literal parser. Evidence: Static path through `isDottedIpv4`, the
local-address check and fallback; both Java digit APIs use Unicode digit
semantics.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
