Skip to content

Commit bb3e67b

Browse files
AcEKaycgRAcEKaycgR
committed
fix: align ipv4 tests strictly to RFC 2673 and move strict CVE checks to URI format
1 parent 0a2e7ce commit bb3e67b

File tree

3 files changed

+61
-25
lines changed

3 files changed

+61
-25
lines changed

‎tests/draft2020-12/optional/format/ipv4.json‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,10 @@
6767
"valid": false
6868
},
6969
{
70-
"description": "invalid leading zeroes, as they are treated as octals",
71-
"comment": "see https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918/",
70+
"description": "leading zeroes are valid per RFC 2673 (despite CVE-2021-28918 octal risks)",
71+
"comment": "see https://sick.codes/universal-netmask-npm-package-used-by-270000-projects-vulnerable-to-octal-input-data-server-side-request-forgery-remote-file-inclusion-local-file-inclusion-and-more-cve-2021-28918/ - NOTE: strict anti-octal rules belong in URI formats for Draft 2020-12, but will be integrated into ipv4 in the v1 spec.",
7272
"data": "087.10.0.1",
73-
"valid": false
73+
"valid": true
7474
},
7575
{
7676
"description": "value without leading zero is valid",
@@ -88,122 +88,122 @@
8888
"valid": false
8989
},
9090
{
91-
"description": "leading zero in last octet (Strict ABNF Compliance)",
92-
"comment": "RFC 3986, Section 3.2.2 strict bounds applied over RFC 2673 to prevent octal vulnerabilities. dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
91+
"description": "leading zero is valid under RFC 2673 loose syntax",
92+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte (where decbyte = 1*3DIGIT). NOTE: Planned for update in v1 spec to enforce strict anti-octal rules.",
9393
"data": "192.168.0.01",
94-
"valid": false
94+
"valid": true
9595
},
9696
{
9797
"description": "leading whitespace is invalid",
98-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
98+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
9999
"data": " 192.168.0.1",
100100
"valid": false
101101
},
102102
{
103103
"description": "trailing whitespace is invalid",
104-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
104+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
105105
"data": "192.168.0.1 ",
106106
"valid": false
107107
},
108108
{
109109
"description": "trailing newline is invalid",
110-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
110+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
111111
"data": "192.168.0.1\n",
112112
"valid": false
113113
},
114114
{
115115
"description": "hexadecimal notation is invalid",
116-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
116+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (requires DIGIT, forbids alpha/hex)",
117117
"data": "0x7f.0.0.1",
118118
"valid": false
119119
},
120120
{
121121
"description": "octal notation explicit is invalid",
122-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
122+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (requires DIGIT, forbids alpha)",
123123
"data": "0o10.0.0.1",
124124
"valid": false
125125
},
126126
{
127127
"description": "empty part (double dot) is invalid",
128-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
128+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
129129
"data": "192.168..1",
130130
"valid": false
131131
},
132132
{
133133
"description": "leading dot is invalid",
134-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
134+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
135135
"data": ".192.168.0.1",
136136
"valid": false
137137
},
138138
{
139139
"description": "trailing dot is invalid",
140-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
140+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
141141
"data": "192.168.0.1.",
142142
"valid": false
143143
},
144144
{
145145
"description": "minimum valid IPv4 address",
146-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT",
146+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT",
147147
"data": "0.0.0.0",
148148
"valid": true
149149
},
150150
{
151151
"description": "maximum valid IPv4 address",
152-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
152+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT",
153153
"data": "255.255.255.255",
154154
"valid": true
155155
},
156156
{
157157
"description": "empty string is invalid",
158-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
158+
"comment": "RFC 2673, Section 3.2: dotted-quad requires 4 decbytes",
159159
"data": "",
160160
"valid": false
161161
},
162162
{
163163
"description": "plus sign is invalid",
164-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
164+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids symbols)",
165165
"data": "+1.2.3.4",
166166
"valid": false
167167
},
168168
{
169169
"description": "negative sign is invalid",
170-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
170+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids symbols)",
171171
"data": "-1.2.3.4",
172172
"valid": false
173173
},
174174
{
175175
"description": "exponential notation is invalid",
176-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
176+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids alpha)",
177177
"data": "1e2.0.0.1",
178178
"valid": false
179179
},
180180
{
181181
"description": "alpha characters are invalid",
182-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
182+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids alpha)",
183183
"data": "192.168.a.1",
184184
"valid": false
185185
},
186186
{
187187
"description": "internal whitespace is invalid",
188-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
188+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
189189
"data": "192. 168.0.1",
190190
"valid": false
191191
},
192192
{
193193
"description": "tab character is invalid",
194-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
194+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
195195
"data": "192.168.0.1\t",
196196
"valid": false
197197
},
198198
{
199199
"description": "with port number is invalid",
200-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet \".\" dec-octet \".\" dec-octet",
200+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
201201
"data": "192.168.0.1:80",
202202
"valid": false
203203
},
204204
{
205205
"description": "single octet out of range in last position",
206-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %d49-57 DIGIT / '1' 2DIGIT / '2' %d48-52 DIGIT / '25' %d48-53",
206+
"comment": "RFC 2673 limits the semantic value of decbyte to 255.",
207207
"data": "192.168.0.256",
208208
"valid": false
209209
}

‎tests/draft2020-12/optional/format/uri-reference.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,24 @@
8080
"description": "invalid backslash character",
8181
"data": "https://example.org/foobar\\.txt",
8282
"valid": false
83+
},
84+
{
85+
"description": "URI Reference containing IPv4 with leading zero in last octet is invalid",
86+
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet... where dec-octet forbids leading zeros to prevent octal parsing.",
87+
"data": "http://192.168.0.01/",
88+
"valid": false
89+
},
90+
{
91+
"description": "URI Reference containing IPv4 with leading zero in first octet is invalid",
92+
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %x31-39 DIGIT...",
93+
"data": "http://01.1.1.1/",
94+
"valid": false
95+
},
96+
{
97+
"description": "URI Reference containing valid strict IPv4",
98+
"comment": "RFC 3986, Section 3.2.2: strictly formatted IPv4 literal in host component",
99+
"data": "http://192.168.0.1/",
100+
"valid": true
83101
}
84102
]
85103
}

‎tests/draft2020-12/optional/format/uri.json‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,24 @@
185185
"description": "invalid | character",
186186
"data": "https://example.org/foobar|.txt",
187187
"valid": false
188+
},
189+
{
190+
"description": "URI containing IPv4 with leading zero in last octet is invalid",
191+
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet... where dec-octet forbids leading zeros to prevent octal parsing.",
192+
"data": "http://192.168.0.01/",
193+
"valid": false
194+
},
195+
{
196+
"description": "URI containing IPv4 with leading zero in first octet is invalid",
197+
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %x31-39 DIGIT...",
198+
"data": "http://01.1.1.1/",
199+
"valid": false
200+
},
201+
{
202+
"description": "URI containing valid strict IPv4",
203+
"comment": "RFC 3986, Section 3.2.2: strictly formatted IPv4 literal in host component",
204+
"data": "http://192.168.0.1/",
205+
"valid": true
188206
}
189207
]
190208
}

0 commit comments

Comments
 (0)