Skip to content

Commit

Permalink
LibURL: Fail parsing IPV4 URLs starting with 0x that overflow
Browse files Browse the repository at this point in the history
Parsing last as an IPV4 number was not returning true in "ends with a
number" as the parsing of that part was overflowing. This means that the
URL is not considered to be an IPv4 address, and is treated as a valid
domain.

Helpfully, the spec also points out in a note that this step is
equivalent to simply checking that the last part ends with 0x followed
by only hex digits - which doesn't suffer from any overflow problem!

Arguably this is an editorial issue in the spec where this should be
clarified a little bit. But for now, fixing this fixes 3 sub tests in
WPT for:

https://wpt.live/url/url-constructor.any.html
(cherry picked from commit 6cac2981fb45498f7e5b84ded2669fb62111da17)
  • Loading branch information
shannonbooth authored and nico committed Oct 15, 2024
1 parent e01e49e commit decc664
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 1 deletion.
2 changes: 2 additions & 0 deletions Tests/LibWeb/Text/expected/URL/invalid-urls.txt
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
new URL('file://xn--/p', undefined)
error creating URL: 'TypeError: Invalid URL'
new URL('http://0xffffffff1', undefined)
error creating URL: 'TypeError: Invalid URL'
1 change: 1 addition & 0 deletions Tests/LibWeb/Text/input/URL/invalid-urls.html
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
test(() => {
const urls = [
{ input: 'file://xn--/p' },
{ input: 'http://0xffffffff1' },
];

for (url of urls) {
Expand Down
3 changes: 2 additions & 1 deletion Userland/Libraries/LibURL/Parser.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -583,7 +583,8 @@ static bool ends_in_a_number_checker(StringView input)
return true;

// 5. If parsing last as an IPv4 number does not return failure, then return true.
if (parse_ipv4_number(last).has_value())
// NOTE: This is equivalent to checking that last is "0X" or "0x", followed by zero or more ASCII hex digits.
if (last.starts_with("0x"sv, CaseSensitivity::CaseInsensitive) && all_of(last.substring_view(2), is_ascii_hex_digit))
return true;

// 6. Return false.
Expand Down

0 comments on commit decc664

Please sign in to comment.