Skip to content

Commit 2c379d3

Browse files
committed
src: fix IPv4 non routable validation
Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com> PR-URL: nodejs-private/node-private#337 CVE-ID: CVE-2022-32212, CVE-2018-7160
1 parent bf4d390 commit 2c379d3

File tree

2 files changed

+9
-0
lines changed

2 files changed

+9
-0
lines changed

src/inspector_socket.cc

+1
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ static std::string TrimPort(const std::string& host) {
164164
static bool IsIPAddress(const std::string& host) {
165165
if (host.length() >= 4 && host.front() == '[' && host.back() == ']')
166166
return true;
167+
if (host.front() == '0') return false;
167168
uint_fast16_t accum = 0;
168169
uint_fast8_t quads = 0;
169170
bool empty = true;

test/cctest/test_inspector_socket.cc

+8
Original file line numberDiff line numberDiff line change
@@ -925,4 +925,12 @@ TEST_F(InspectorSocketTest, HostIpTooManyOctetsChecked) {
925925
expect_handshake_failure();
926926
}
927927

928+
TEST_F(InspectorSocketTest, HostIPNonRoutable) {
929+
const std::string INVALID_HOST_IP_REQUEST = "GET /json HTTP/1.1\r\n"
930+
"Host: 0.0.0.0:9229\r\n\r\n";
931+
send_in_chunks(INVALID_HOST_IP_REQUEST.c_str(),
932+
INVALID_HOST_IP_REQUEST.length());
933+
expect_handshake_failure();
934+
}
935+
928936
} // anonymous namespace

0 commit comments

Comments
 (0)