-
Notifications
You must be signed in to change notification settings - Fork 12.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ipv4Addr: Incorrect Parsing for Octal format IP string #83648
Comments
While the fix should be quite straightforward, there are two possible solutions:
|
It's not at all obvious that we should parse octal IP addresses. Seems exceedingly unlikely to come up outside of security advisories. I would venture a guess that if we added this, far more people would be tripped up by it happening unexpectedly than would ever use it intentionally. |
I agree. So I think disallowing octal string like Nevertheless, the current implementation in Rust std library should be considered as a (low-risk?) security vulnerability. |
Disallow octal format in Ipv4 string In its original specification, leading zero in Ipv4 string is interpreted as octal literals. So a IP address 0127.0.0.1 actually means 87.0.0.1. This confusion can lead to many security vulnerabilities. Therefore, in [IETF RFC 6943], it suggests to disallow octal/hexadecimal format in Ipv4 string all together. Existing implementation already disallows hexadecimal numbers. This commit makes Parser reject octal numbers. Fixes rust-lang#83648. [IETF RFC 6943]: https://tools.ietf.org/html/rfc6943#section-3.1.1
This issue is inspired by this blog.
Due to the specification, leading zero in IP string is interpreted as octal literals. So a IP address
0127.0.0.1
actually means87.0.0.1
. As shown in the following example:However, the
Ipv4Addr
from the std library will recognize it as127.0.0.1
instead. A simple code to demo the situation (playground link):I expected to see this happen:
Instead, this happened:
Noted this bug may cause security vulnerabilities in certain cases. For example, a Rust program uses
Ipv4Addr
doing some sanity check then passing the user string to other library or program.Furthermore, the specification actually also allows hex format in IP string.
Meta
rustc --version --verbose
:The text was updated successfully, but these errors were encountered: