From b3700ff975d324c0feafbb81be6c6972d4cc8411 Mon Sep 17 00:00:00 2001 From: Ryan Schmitt Date: Tue, 2 Dec 2025 08:40:06 -0800 Subject: [PATCH] Fix validation of 0/8 IPv4 addresses 0.0.0.0/8 IPv4 addresses are not illegal, just "reserved." This change brings `InetAddressUtils` in line with the JDK's `InetAddress` implementation, which accepts these addresses without issue, e.g.: ```java InetAddress.getByAddress(new byte[]{ 0, 10, 25, 68 }); InetAddress.getByName("0.10.25.68"); ``` --- .../main/java/org/apache/hc/core5/net/InetAddressUtils.java | 3 +-- .../java/org/apache/hc/core5/net/TestInetAddressUtils.java | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/httpcore5/src/main/java/org/apache/hc/core5/net/InetAddressUtils.java b/httpcore5/src/main/java/org/apache/hc/core5/net/InetAddressUtils.java index 21dadf1cb..1ffaba89f 100644 --- a/httpcore5/src/main/java/org/apache/hc/core5/net/InetAddressUtils.java +++ b/httpcore5/src/main/java/org/apache/hc/core5/net/InetAddressUtils.java @@ -59,8 +59,7 @@ private InetAddressUtils() { } private static final String IPV4_BASIC_PATTERN_STRING = - "(([1-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){1}" + // initial first field, 1-255 - "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){2}" + // following 2 fields, 0-255 followed by . + "(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}" + // First 3 fields, 0-255, followed by . "([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])"; // final field, 0-255 private static final Pattern IPV4_PATTERN = diff --git a/httpcore5/src/test/java/org/apache/hc/core5/net/TestInetAddressUtils.java b/httpcore5/src/test/java/org/apache/hc/core5/net/TestInetAddressUtils.java index 3c1541fce..32e080a26 100644 --- a/httpcore5/src/test/java/org/apache/hc/core5/net/TestInetAddressUtils.java +++ b/httpcore5/src/test/java/org/apache/hc/core5/net/TestInetAddressUtils.java @@ -44,6 +44,7 @@ void testValidIPv4Address() { Assertions.assertTrue(InetAddressUtils.isIPv4("127.0.0.1")); Assertions.assertTrue(InetAddressUtils.isIPv4("192.168.0.0")); Assertions.assertTrue(InetAddressUtils.isIPv4("255.255.255.255")); + Assertions.assertTrue(InetAddressUtils.isIPv4("0.168.0.0")); } @Test @@ -52,7 +53,6 @@ void testInvalidIPv4Address() { Assertions.assertFalse(InetAddressUtils.isIPv4("g.ar.ba.ge")); Assertions.assertFalse(InetAddressUtils.isIPv4("192.168.0")); Assertions.assertFalse(InetAddressUtils.isIPv4("256.255.255.255")); - Assertions.assertFalse(InetAddressUtils.isIPv4("0.168.0.0")); //IP address that starts with zero not allowed } @Test