From: Mohit Agarwal <mohit@sdf.org>
Date: Thu, 21 Apr 2016 19:17:04 +0000 (+0530)
Subject: net/url: validate ports in IPv4 addresses
X-Git-Tag: go1.7beta1~525
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=9f1ccd647fcdb1b703c1042c90434e15aff75013;p=gostls13.git

net/url: validate ports in IPv4 addresses

Fixes #14860

Change-Id: Id55ad942d45a104d560a879d6e8e1aa09671789b
Reviewed-on: https://go-review.googlesource.com/22351
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
---

diff --git a/src/net/url/url.go b/src/net/url/url.go
index d9c8c49e94..05b41fa964 100644
--- a/src/net/url/url.go
+++ b/src/net/url/url.go
@@ -573,8 +573,12 @@ func parseHost(host string) (string, error) {
 			}
 			return host1 + host2 + host3, nil
 		}
+	} else if i := strings.LastIndex(host, ":"); i > 0 {
+		colonPort := host[i:]
+		if !validOptionalPort(colonPort) {
+			return "", fmt.Errorf("invalid port %q after host", colonPort)
+		}
 	}
-
 	var err error
 	if host, err = unescape(host, encodeHost); err != nil {
 		return "", err
diff --git a/src/net/url/url_test.go b/src/net/url/url_test.go
index 7560f22c4a..da6bc2843e 100644
--- a/src/net/url/url_test.go
+++ b/src/net/url/url_test.go
@@ -418,10 +418,10 @@ var urltests = []URLTest{
 	},
 	// worst case host, still round trips
 	{
-		"scheme://!$&'()*+,;=hello!:port/path",
+		"scheme://!$&'()*+,;=hello!:8080/path",
 		&URL{
 			Scheme: "scheme",
-			Host:   "!$&'()*+,;=hello!:port",
+			Host:   "!$&'()*+,;=hello!:8080",
 			Path:   "/path",
 		},
 		"",
@@ -636,8 +636,10 @@ var parseRequestURLTests = []struct {
 	{"*", true},
 	{"http://192.168.0.1/", true},
 	{"http://192.168.0.1:8080/", true},
+	{"http://192.168.0.1:foo/", false},
 	{"http://[fe80::1]/", true},
 	{"http://[fe80::1]:8080/", true},
+	{"http://[fe80::1]:foo/", false},
 
 	// Tests exercising RFC 6874 compliance:
 	{"http://[fe80::1%25en0]/", true},                 // with alphanum zone identifier