From cec022dec871d2396ffe488df8c809b6ba92085c Mon Sep 17 00:00:00 2001
From: S410 <47976572+Sierra410@users.noreply.github.com>
Date: Mon, 30 Nov 2020 13:32:04 +0000
Subject: [PATCH] fix: isHostname reports malformed IPv6 addresses as valid
 (#946)

* fix: isHostname reports malformed IPv6 addresses as valid
* test: isHostname() malformed ipv6 tests
---
 add-on/src/lib/options.js           | 14 +++++++++++++-
 test/functional/lib/options.test.js |  9 +++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/add-on/src/lib/options.js b/add-on/src/lib/options.js
index 0c6dd552d..454c31c34 100644
--- a/add-on/src/lib/options.js
+++ b/add-on/src/lib/options.js
@@ -119,7 +119,19 @@ exports.safeURL = safeURL
 exports.guiURLString = guiURLString
 
 // ensure value is a valid URL.hostname (FQDN || ipv4 || ipv6 WITH brackets)
-exports.isHostname = x => isFQDN(x) || isIP.v4(x) || (!isIP.v6(x) && isIP.v6(x.replace(/[[\]]+/g, '')))
+exports.isHostname = x => {
+  if (isFQDN(x) || isIP.v4(x)) {
+    return true
+  }
+
+  const match = x.match(/^\[(.*)\]$/)
+
+  if (match == null) {
+    return false
+  }
+
+  return isIP.v6(match[1])
+}
 
 // convert JS array to multiline textarea
 function hostArrayCleanup (array) {
diff --git a/test/functional/lib/options.test.js b/test/functional/lib/options.test.js
index abbd69ea2..0f1f993b4 100644
--- a/test/functional/lib/options.test.js
+++ b/test/functional/lib/options.test.js
@@ -77,6 +77,15 @@ describe('isHostname()', function () {
   it('should return false for invalid URL.hostname (ipv6 without brackets)', () => {
     expect(isHostname('fe80::bb67:770c:8a97:1')).to.equal(false)
   })
+  it('should return false for ipv6 with a missing bracket', () => {
+    expect(
+      isHostname('[fe80::bb67:770c:8a97:1') ||
+      isHostname('fe80::bb67:770c:8a97:1]')
+    ).to.equal(false)
+  })
+  it('should return false for ipv6 with malformed brackets', () => {
+    expect(isHostname('[fe80::bb67:770c:8a97]:1]')).to.equal(false)
+  })
 })
 
 describe('hostTextToArray()', function () {