url: should validate ipv4 part length

nodejs · Apr 29, 2022 · 4e446a9 · 4e446a9
1 parent 27ecf1d
commit 4e446a9
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/src/node_url.cc b/src/node_url.cc
@@ -411,8 +411,11 @@ void URLHost::ParseIPv4Host(const char* input, size_t length, bool* is_ipv4) {
     const char ch = pointer < end ? pointer[0] : kEOL;
     int64_t remaining = end - pointer - 1;
     if (ch == '.' || ch == kEOL) {
-      if (++parts > static_cast<int>(arraysize(numbers)))
+      // If parts’s size is greater than 4, validation error, return failure.
+      if (++parts > static_cast<int>(arraysize(numbers))) {
+        *is_ipv4 = true;
         return;
+      }
       if (pointer == mark)
         return;
       int64_t n = ParseNumber(mark, pointer);

diff --git a/test/parallel/test-whatwg-url-ipv4.js b/test/parallel/test-whatwg-url-ipv4.js
@@ -0,0 +1,8 @@
+'use strict';
+
+require('../common');
+
+const assert = require('assert');
+
+assert.throws(() => new URL('https://256.256.256.256'), { code: 'ERR_INVALID_URL' });
+assert.throws(() => new URL('https://256.256.256.256.256'), { code: 'ERR_INVALID_URL' });