[Django] #28754: validate_ipv46_address validator allows IP addresses to begin with a first octet of zero
Django
octet of zero
-------------------------------------+-------------------------------------
Reporter: frankston | Owner: nobody
Type: Bug | Status: new
Component: Core | Version: 1.11
(Other) | Keywords: IP, regular
Severity: Normal | expression
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
-------------------------------------+-------------------------------------
The regular expression used by the
[https://docs.djangoproject.com/en/1.11/_modules/django/core/validators/#validate_ipv46_address
validate_ipv46_address] validator allows IP addresses to begin with a
first octet of zero.
For example the following IPs are incorrectly identified as being valid:
0.1.2.3
0.90.11.2
--
Ticket URL: <https://code.djangoproject.com/ticket/28754>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
Django
octet of zero
-------------------------------------+-------------------------------------
Reporter: frankston | Owner: nobody
Type: Bug | Status: new
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
expression | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Old description:
> The regular expression used by the
> [https://docs.djangoproject.com/en/1.11/_modules/django/core/validators/#validate_ipv46_address
> validate_ipv46_address] validator allows IP addresses to begin with a
> first octet of zero.
>
> For example the following IPs are incorrectly identified as being valid:
> 0.1.2.3
> 0.90.11.2
New description:
The regular expression used by the
[https://docs.djangoproject.com/en/1.11/_modules/django/core/validators/#validate_ipv46_address
validate_ipv46_address] validator allows IP addresses to begin with a
first octet of zero.
For example the following IPs are incorrectly identified as being valid:
0.1.2.3
0.90.11.2
As a side note the ping command (on Ubuntu at least) sees this as an
invalid IP:
~$ ping 0.1.2.3
connect: Invalid argument
--
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:1>
Django
octet of zero
-------------------------------------+-------------------------------------
Reporter: frankston | Owner: nobody
Type: Bug | Status: new
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
expression | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Tim Graham):
"0.0.0.0" is listed as a valid address in Django's tests. I'm not sure if
it's worth prohibiting other addresses that start with 0.
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:2>
Django
octet of zero
-------------------------------------+-------------------------------------
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.11
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
expression | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
* status: new => assigned
* owner: nobody => Tim G.
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:3>
Django
octet of zero
-------------------------------------+-------------------------------------
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.11
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
expression | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Tim G.):
PR is ready for review: https://github.com/django/django/pull/9321
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:4>
Django
octet of zero
-------------------------------------+-------------------------------------
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.11
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
expression | Unreviewed
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
* has_patch: 0 => 1
Comment:
Specifically, my concern is that the proposed regular expression is much
more complicated and less readable. Part of that concern is because we've
had security issues due to complicated regular expressions that are
vulnerable to catastrophic backtracking.
Tim, pull requests should go to the master branch rather than a stable
branch. The committer will take care of backporting if needed, but this
fix doesn't qualify for a backport to 1.11 based on our
[https://docs.djangoproject.com/en/dev/internals/release-process
/#supported-versions supported versions policy]. Don't forget to check
"Has patch" on the ticket so that it appears in the review queue.
Generally, you may not want to work on a ticket until it's "Triage Stage"
is moved to "Accepted" to indicate a consensus to make a change (although
seeing a patch for this is helpful in determining if the additional
complexity is worthwhile).
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:5>
Django
octet of zero
-------------------------------------+-------------------------------------
Type: Bug | Status: assigned
Component: Core (Other) | Version: 1.11
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
* has_patch: 1 => 0
* stage: Unreviewed => Someday/Maybe
Comment:
As suggested on the pull request, we should check if cpython would fix
this issue as Django uses `ipaddress.IPv4Address` for validation. If so, I
don't think we need to patch Django just to fix this issue for older
versions of Python.
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:6>
Django
octet of zero
-------------------------------------+-------------------------------------
Type: Bug | Status: new
Component: Core (Other) | Version: 1.11
Severity: Normal | Resolution:
Keywords: IP, regular | Triage Stage:
expression | Someday/Maybe
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
Changes (by Tim Graham):
* status: assigned => new
* owner: Tim G. => (none)
* easy: 1 => 0
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:7>
Django
octet of zero
-------------------------------------+-------------------------------------
Type: Bug | Status: closed
Component: Core (Other) | Version: 1.11
Severity: Normal | Resolution: invalid
Keywords: IP, regular | Triage Stage:
expression | Someday/Maybe
Needs tests: 0 | Patch needs improvement: 0
-------------------------------------+-------------------------------------
* status: new => closed
* resolution: => invalid
Comment:
* Since #27793, Django's IP address validation is a think wrapper around
Python's `ipaddress` module, we don't use regexps anymore. As far as I can
tell, no issue was ever opened against cpython to request that leading 0
in IP addresses be marked as invalid [1].
* I can't find a reference explaining why IP address starting with 0 would
be invalid (RFC 1700 [2] says they are valid but "can only be used as a
source address"). On my machine, `ping 0.1.2.3` does not give any error.
For these reasons, I'm going to mark this ticket as invalid. Feel free to
reopen if I've missed something or if you disagree.
[1]
https://bugs.python.org/issue?%40search_text=&ignore=file%3Acontent&title=ipaddress&%40columns=title&id=&%40columns=id&stage=&creation=&creator=&activity=&%40columns=activity&%40sort=activity&actor=&nosy=&type=&components=&versions=&dependencies=&assignee=&keywords=&priority=&status=&%40columns=status&resolution=&nosy_count=&message_count=&%40group=&%40pagesize=50&%40startwith=0&%40sortdir=on&%40action=search
[2] https://tools.ietf.org/html/rfc1700#page-4
--
Ticket URL: <https://code.djangoproject.com/ticket/28754#comment:8>