]> Cypherpunks repositories - gostls13.git/commit
[release-branch.go1.24] net/url: enforce stricter parsing of bracketed IPv6 hostnames
authorEthan Lee <ethanalee@google.com>
Fri, 29 Aug 2025 17:35:55 +0000 (17:35 +0000)
committerGopher Robot <gobot@golang.org>
Tue, 7 Oct 2025 18:00:42 +0000 (11:00 -0700)
commitd6d2f7bf76718f1db05461cd912ae5e30d7b77ea
tree462bc7b89c448d6de07fea0677b6b7072166b7cd
parenta402f4ad285514f5f3db90516d72047d591b307a
[release-branch.go1.24] net/url: enforce stricter parsing of bracketed IPv6 hostnames

- Previously, url.Parse did not enforce validation of hostnames within
  square brackets.
- RFC 3986 stipulates that only IPv6 hostnames can be embedded within
  square brackets in a URL.
- Now, the parsing logic should strictly enforce that only IPv6
  hostnames can be resolved when in square brackets. IPv4, IPv4-mapped
  addresses and other input will be rejected.
- Update url_test to add test cases that cover the above scenarios.

Thanks to Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua
University for reporting this issue.

Fixes CVE-2025-47912
Fixes #75678
Fixes #75712

Change-Id: Iaa41432bf0ee86de95a39a03adae5729e4deb46c
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2680
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2968
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/709838
TryBot-Bypass: Michael Pratt <mpratt@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>
Auto-Submit: Michael Pratt <mpratt@google.com>
src/go/build/deps_test.go
src/net/url/url.go
src/net/url/url_test.go