49 lines
1.9 KiB
Diff
49 lines
1.9 KiB
Diff
From b358fb27a4253c6827378a64163448c04301e19c Mon Sep 17 00:00:00 2001
|
|
From: RafaelGSS <rafael.nunu@hotmail.com>
|
|
Date: Wed, 13 Jul 2022 13:20:22 -0300
|
|
Subject: [PATCH] src: fix IPv4 non routable validation
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
|
|
Reviewed-By: James M Snell <jasnell@gmail.com>
|
|
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
|
|
Reviewed-By: Juan José Arboleda <soyjuanarbol@gmail.com>
|
|
PR-URL: https://github.com/nodejs-private/node-private/pull/337
|
|
CVE-ID: CVE-2022-32212, CVE-2018-7160
|
|
---
|
|
src/inspector_socket.cc | 1 +
|
|
test/cctest/test_inspector_socket.cc | 8 ++++++++
|
|
2 files changed, 9 insertions(+)
|
|
|
|
diff --git a/src/inspector_socket.cc b/src/inspector_socket.cc
|
|
index 79b50e6a452d..ab1cdf1fa5bd 100644
|
|
--- a/src/inspector_socket.cc
|
|
+++ b/src/inspector_socket.cc
|
|
@@ -164,6 +164,7 @@ static std::string TrimPort(const std::string& host) {
|
|
static bool IsIPAddress(const std::string& host) {
|
|
if (host.length() >= 4 && host.front() == '[' && host.back() == ']')
|
|
return true;
|
|
+ if (host.front() == '0') return false;
|
|
uint_fast16_t accum = 0;
|
|
uint_fast8_t quads = 0;
|
|
bool empty = true;
|
|
diff --git a/test/cctest/test_inspector_socket.cc b/test/cctest/test_inspector_socket.cc
|
|
index c740d961d9b7..6ae92c4b27e2 100644
|
|
--- a/test/cctest/test_inspector_socket.cc
|
|
+++ b/test/cctest/test_inspector_socket.cc
|
|
@@ -925,4 +925,12 @@ TEST_F(InspectorSocketTest, HostIpTooManyOctetsChecked) {
|
|
expect_handshake_failure();
|
|
}
|
|
|
|
+TEST_F(InspectorSocketTest, HostIPNonRoutable) {
|
|
+ const std::string INVALID_HOST_IP_REQUEST = "GET /json HTTP/1.1\r\n"
|
|
+ "Host: 0.0.0.0:9229\r\n\r\n";
|
|
+ send_in_chunks(INVALID_HOST_IP_REQUEST.c_str(),
|
|
+ INVALID_HOST_IP_REQUEST.length());
|
|
+ expect_handshake_failure();
|
|
+}
|
|
+
|
|
} // anonymous namespace
|