This is an automated email from the ASF dual-hosted git repository. chibenwa pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/james-jspf.git
commit 273441d322a6d97f60ef49cdebdc7e9006b33714 Author: Quan Tran <[email protected]> AuthorDate: Fri Oct 30 16:45:01 2026 +0700 [FIX] IPAddr: reject what is no IP address before converting it stringToInternal handed any string to Inet6Util.createByteArrayFromIPAddressString, which expects a valid address: "" and "[" threw StringIndexOutOfBoundsException, more than 8 groups or 4 dotted parts ArrayIndexOutOfBoundsException, and a group without ":" or "." was ignored, so isIPAddr("2") was true (read as ::). Validate the address first, as isValidIP does: anything else is the documented PermErrorException, and isIPAddr is false. --- resolver/src/main/java/org/apache/james/jspf/core/IPAddr.java | 5 +++++ .../src/test/java/org/apache/james/jspf/core/IPAddrTest.java | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/resolver/src/main/java/org/apache/james/jspf/core/IPAddr.java b/resolver/src/main/java/org/apache/james/jspf/core/IPAddr.java index e390e91..e4d58ee 100644 --- a/resolver/src/main/java/org/apache/james/jspf/core/IPAddr.java +++ b/resolver/src/main/java/org/apache/james/jspf/core/IPAddr.java @@ -180,6 +180,11 @@ public class IPAddr { */ private void stringToInternal(String netAddress) throws PermErrorException { netAddress = stripDot(netAddress); + // createByteArrayFromIPAddressString expects a valid address: it fails on "" or "[", ignores + // a group without ":" or "." ("2" read as ::), and writes past its array on too many groups + if (!isValidIP(netAddress)) { + throw new PermErrorException("Not a valid address: " + netAddress); + } try { byte[] bytes = Inet6Util.createByteArrayFromIPAddressString(netAddress); diff --git a/resolver/src/test/java/org/apache/james/jspf/core/IPAddrTest.java b/resolver/src/test/java/org/apache/james/jspf/core/IPAddrTest.java index a5f689d..e66213d 100644 --- a/resolver/src/test/java/org/apache/james/jspf/core/IPAddrTest.java +++ b/resolver/src/test/java/org/apache/james/jspf/core/IPAddrTest.java @@ -67,6 +67,16 @@ public class IPAddrTest extends TestCase { assertFalse(Inet6Util.isValidIP6Address("1:2:3:4:5:6:7")); } + public void testIsIPAddrRejectsWhatIsNoAddress() { + assertFalse(IPAddr.isIPAddr("")); + assertFalse(IPAddr.isIPAddr("[")); + assertFalse(IPAddr.isIPAddr("2")); + assertFalse(IPAddr.isIPAddr("1:2:3:4:5:6:7:8:9")); + assertFalse(IPAddr.isIPAddr("1.2.3.4.5")); + assertTrue(IPAddr.isIPAddr("192.0.2.1")); + assertTrue(IPAddr.isIPAddr("2001:db8::1")); + } + public void testInvalidIp6Address() throws PermErrorException { try { assertEquals("ip6", IPAddr.getInAddress("12AB:0:0:CD3")); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
