Skip to content

Commit d7d3ff0

Browse files
AcEKaycgRAcEKaycgR
committed
feat: enforce strict anti-octal ipv4 tests in v1 spec
1 parent b9d6f63 commit d7d3ff0

File tree

3 files changed

+120
-36
lines changed

3 files changed

+120
-36
lines changed

‎tests/draft2020-12/optional/format/uri-reference.json‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -80,24 +80,6 @@
8080
"description": "invalid backslash character",
8181
"data": "https://example.org/foobar\\.txt",
8282
"valid": false
83-
},
84-
{
85-
"description": "URI Reference: IPv4 with leading zero in last octet invalid",
86-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet... where dec-octet forbids leading zeros to prevent octal parsing.",
87-
"data": "http://192.168.0.01/",
88-
"valid": false
89-
},
90-
{
91-
"description": "URI Reference: IPv4 with leading zero in first octet invalid",
92-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %x31-39 DIGIT...",
93-
"data": "http://01.1.1.1/",
94-
"valid": false
95-
},
96-
{
97-
"description": "URI Reference containing valid strict IPv4",
98-
"comment": "RFC 3986, Section 3.2.2: strictly formatted IPv4 literal in host component",
99-
"data": "http://192.168.0.1/",
100-
"valid": true
10183
}
10284
]
10385
}

‎tests/draft2020-12/optional/format/uri.json‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -185,24 +185,6 @@
185185
"description": "invalid | character",
186186
"data": "https://example.org/foobar|.txt",
187187
"valid": false
188-
},
189-
{
190-
"description": "URI containing IPv4 with leading zero in last octet is invalid",
191-
"comment": "RFC 3986, Section 3.2.2: IPv4address = dec-octet \".\" dec-octet... where dec-octet forbids leading zeros to prevent octal parsing.",
192-
"data": "http://192.168.0.01/",
193-
"valid": false
194-
},
195-
{
196-
"description": "URI containing IPv4 with leading zero in first octet is invalid",
197-
"comment": "RFC 3986, Section 3.2.2: dec-octet = DIGIT / %x31-39 DIGIT...",
198-
"data": "http://01.1.1.1/",
199-
"valid": false
200-
},
201-
{
202-
"description": "URI containing valid strict IPv4",
203-
"comment": "RFC 3986, Section 3.2.2: strictly formatted IPv4 literal in host component",
204-
"data": "http://192.168.0.1/",
205-
"valid": true
206188
}
207189
]
208190
}

‎tests/v1/format/ipv4.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,126 @@
8686
"description": "netmask is not a part of ipv4 address",
8787
"data": "192.168.1.0/24",
8888
"valid": false
89+
},
90+
{
91+
"description": "leading zero in last octet is invalid in v1 (anti-octal)",
92+
"comment": "JSON Schema v1 moves to strict anti-octal rules (like RFC 3986 dec-octet) to prevent vulnerabilities like CVE-2021-28918.",
93+
"data": "192.168.0.01",
94+
"valid": false
95+
},
96+
{
97+
"description": "leading whitespace is invalid",
98+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
99+
"data": " 192.168.0.1",
100+
"valid": false
101+
},
102+
{
103+
"description": "trailing whitespace is invalid",
104+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
105+
"data": "192.168.0.1 ",
106+
"valid": false
107+
},
108+
{
109+
"description": "trailing newline is invalid",
110+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
111+
"data": "192.168.0.1\n",
112+
"valid": false
113+
},
114+
{
115+
"description": "hexadecimal notation is invalid",
116+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (requires DIGIT, forbids alpha/hex)",
117+
"data": "0x7f.0.0.1",
118+
"valid": false
119+
},
120+
{
121+
"description": "octal notation explicit is invalid",
122+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (requires DIGIT, forbids alpha)",
123+
"data": "0o10.0.0.1",
124+
"valid": false
125+
},
126+
{
127+
"description": "empty part (double dot) is invalid",
128+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
129+
"data": "192.168..1",
130+
"valid": false
131+
},
132+
{
133+
"description": "leading dot is invalid",
134+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
135+
"data": ".192.168.0.1",
136+
"valid": false
137+
},
138+
{
139+
"description": "trailing dot is invalid",
140+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
141+
"data": "192.168.0.1.",
142+
"valid": false
143+
},
144+
{
145+
"description": "minimum valid IPv4 address",
146+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT",
147+
"data": "0.0.0.0",
148+
"valid": true
149+
},
150+
{
151+
"description": "maximum valid IPv4 address",
152+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT",
153+
"data": "255.255.255.255",
154+
"valid": true
155+
},
156+
{
157+
"description": "empty string is invalid",
158+
"comment": "RFC 2673, Section 3.2: dotted-quad requires 4 decbytes",
159+
"data": "",
160+
"valid": false
161+
},
162+
{
163+
"description": "plus sign is invalid",
164+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids symbols)",
165+
"data": "+1.2.3.4",
166+
"valid": false
167+
},
168+
{
169+
"description": "negative sign is invalid",
170+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids symbols)",
171+
"data": "-1.2.3.4",
172+
"valid": false
173+
},
174+
{
175+
"description": "exponential notation is invalid",
176+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids alpha)",
177+
"data": "1e2.0.0.1",
178+
"valid": false
179+
},
180+
{
181+
"description": "alpha characters are invalid",
182+
"comment": "RFC 2673, Section 3.2: decbyte = 1*3DIGIT (forbids alpha)",
183+
"data": "192.168.a.1",
184+
"valid": false
185+
},
186+
{
187+
"description": "internal whitespace is invalid",
188+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
189+
"data": "192. 168.0.1",
190+
"valid": false
191+
},
192+
{
193+
"description": "tab character is invalid",
194+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
195+
"data": "192.168.0.1\t",
196+
"valid": false
197+
},
198+
{
199+
"description": "with port number is invalid",
200+
"comment": "RFC 2673, Section 3.2: dotted-quad = decbyte \".\" decbyte \".\" decbyte \".\" decbyte",
201+
"data": "192.168.0.1:80",
202+
"valid": false
203+
},
204+
{
205+
"description": "single octet out of range in last position",
206+
"comment": "RFC 2673 limits the semantic value of decbyte to 255.",
207+
"data": "192.168.0.256",
208+
"valid": false
89209
}
90210
]
91211
}

0 commit comments

Comments
 (0)