Related to: #75678
Hi! 👋
I've been asked to turn #75678 (comment) into a dedicated issue…
The recent fix to vulnerability CVE-2025-47912 in commit f6f4e8b introduced a test case…
|
{"https://[::ffff:192.0.2.1]", false}, |
…that is in conflict with RFC 3986: The URI/URL is well-formed with regard to RFC 3986 — mapped IPv4 addresses are allowed (rather than forbidden) by RFC 3986 — and so the expected result is true rather than false: the URI/URL should not be rejected.
Would be cool if that could be fixed. Thanks!
PS: Full disclosure, I'm the author of https://github.com/uriparser/uriparser that implements RFC 3986 in C89.
Best, Sebastian
CC @rolandshoemaker
Related to: #75678
Hi! 👋
I've been asked to turn #75678 (comment) into a dedicated issue…
The recent fix to vulnerability CVE-2025-47912 in commit f6f4e8b introduced a test case…
go/src/net/url/url_test.go
Line 729 in d4830c6
…that is in conflict with RFC 3986: The URI/URL is well-formed with regard to RFC 3986 — mapped IPv4 addresses are allowed (rather than forbidden) by RFC 3986 — and so the expected result is
truerather thanfalse: the URI/URL should not be rejected.Would be cool if that could be fixed. Thanks!
PS: Full disclosure, I'm the author of https://github.com/uriparser/uriparser that implements RFC 3986 in C89.
Best, Sebastian
CC @rolandshoemaker