]> Cypherpunks repositories - gostls13.git/commit
[release-branch.go1.24] net/url: allow IP-literals with IPv4-mapped IPv6 addresses
authorRoland Shoemaker <roland@golang.org>
Thu, 9 Oct 2025 00:13:12 +0000 (17:13 -0700)
committerGopher Robot <gobot@golang.org>
Fri, 17 Oct 2025 22:02:30 +0000 (15:02 -0700)
commita216ddc295c3e983f78a7ff911ae20ca147b09b7
treedb602e63ef163273766795f3023b8f6342864750
parent8e10ef451a1b6a1e8861ced1154e1c3265bfa01b
[release-branch.go1.24] net/url: allow IP-literals with IPv4-mapped IPv6 addresses

The security fix we applied in CL709857 was overly broad. It applied
rules from RFC 2732, which disallowed IPv4-mapped IPv6 addresses, but
these were later allowed in RFC 3986, which is the canonical URI syntax
RFC.

Revert the portion of CL709857 which restricted IPv4-mapped addresses,
and update the related tests.

Updates #75815
Fixes #75831

Change-Id: I3192f2275ad5c386f5c15006a6716bdb5282919d
Reviewed-on: https://go-review.googlesource.com/c/go/+/710375
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ethan Lee <ethanalee@google.com>
Auto-Submit: Roland Shoemaker <roland@golang.org>
(cherry picked from commit 9db7e30bb42eed9912f5e7e9e3959f3b38879d5b)
Reviewed-on: https://go-review.googlesource.com/c/go/+/712142
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
src/net/url/url.go
src/net/url/url_test.go