Make is_ipaddress detect non-standard forms of IPv4 addresses - #5029
Conversation
|
+0 Is it desirable to pass through ambiguous formats straight to socket.connect? I don't feel strongly here, but just wanted to note that the stdlib Hypothetically, I can imagine some years from now a CVE where something is relying on filtering out some specific addresses is getting bypassed by rewriting those addresses with non-standard variants. 🤪 |
I just don't feel like we need to make a breaking change - disallow such forms of IPv4. But if we keep support for them, the function has to aligned.
My next change will be related to this 😄. I want to update the security policy to mention that vulnerability reports about SSRF will not be accepted because urllib3 does not provide the functionality. |
@christos-spearbit highlighted that urllib3 can connect to hosts represented as non-standard IPv4 addresses via
socket.connect(e.g.,urllib3.request("GET", "http://2130706433:8000/")), but ouris_ipaddressfunction does not detect such forms so some logic of the library that relies onis_ipaddressmay be missed.I update the
_IPV4_REregex to match the forms too.FYI, non-standard IPv4 forms are not allowed inside IPv4-mapped IPv6 addresses like
::ffff:192.168.1.1, so urllib3's logic for them is aligned with RFCs.