Reject IPv4 octets with leading zeros in the ipv4 format check#207
Open
chuenchen309 wants to merge 1 commit into
Open
Reject IPv4 octets with leading zeros in the ipv4 format check#207chuenchen309 wants to merge 1 commit into
chuenchen309 wants to merge 1 commit into
Conversation
The `ipv4` format regex used octet sub-patterns `1?[0-9][0-9]?` /
`[01]?[0-9][0-9]?`, which match two-digit leading-zero octets such as `01`,
`04`, `00`. Per the JSON Schema test suite an address like `01.2.3.4` or
`1.2.3.04` is invalid ("invalid leading zeroes, as they are treated as
octals" — cf. CVE-2021-28918), so the validator was accepting malformed input.
Tighten every octet to `25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]`, which
still allows a single `0` (e.g. `0.0.0.0`) but rejects any leading zero.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
ipv4format check accepts IPv4 octets with leading zeros, which are invalid per the JSON Schema spec:Root cause (
fastjsonschema/draft04.py, theipv4entry inFORMAT_REGEXS, inherited unchanged by draft06/07/2019): the octet sub-patterns1?[0-9][0-9]?and[01]?[0-9][0-9]?both match two-digit leading-zero octets like01,04,00.The official JSON-Schema-Test-Suite
optional/format/ipv4.jsonrequires these to be rejected — "invalid leading zeroes, as they are treated as octals" (the comment cites CVE-2021-28918, an octal-parsing SSRF class). The vendored suite doesn't catch it because its only leading-zero case is the 3-digit087.10.0.1, which the old regex happens to reject; the 2-digit gap was uncovered.Fix: tighten each octet to
25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]— a single0is still allowed (0.0.0.0stays valid), but no leading zeros.Verification (re-runnable from the diff):
01.2.3.4,1.2.3.04,00.1.2.3accepted. After: rejected.0.0.0.0,87.10.0.1,255.255.255.255still accepted.test_ipv4intests/test_format.py— they fail on the current regex and pass with the fix;tests/test_format.py→ 45 passed.ipv4.json, including087.10.0.1and256.256.256.256).Same vein as the recently merged format-regex fixes (#196 ipv6, #191 date).
Disclosure: This PR was authored by an AI coding agent (Claude Code) running on this account: the AI found the bug, ran the repro, wrote the test, and wrote this description. The human account holder reviews every change and is accountable for it. The verification above is real and re-runnable from the diff. If this isn't the kind of contribution you want, say so and I'll close it.