x/net/publicsuffix: EffectiveTLDPlusOne accepts IP Addresses

[Agronis]

What version of Go are you using (go version)?

$ go version
go version go1.12.4 darwin/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/x/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/x/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/go"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/hf/v0mqyvgn6h79sjd8c8t7dy540000gn/T/go-build875757611=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

By passing an IP address into this function, I am provided the last index of the Network ID, and the Host ID (3rd & 4th position).

package main

import (
	"fmt"
	"net/url"

	"golang.org/x/net/publicsuffix"
)

func main() {
	u, _ := url.Parse("http://192.168.1.1/")
	fmt.Println(publicsuffix.EffectiveTLDPlusOne(u.Hostname()))
}

What did you expect to see?

An error stating that what was provided was...

• not a valid domain
  or
• an IP address

What did you see instead?

1.1

Validation should occur to ensure that what is being passed matches the named parameter, domain.

Validation is already present: https://github.com/golang/net/blame/da137c7871d730100384dbcf36e6f8fa493aef5b/publicsuffix/list.go#L168

To argue that this function should not be responsible for checking if this is a valid domain name would be counterintuitive to L168 linked above.

If this is not the responsibility of this function to ensure what is being passed is actually a domain, then I propose changing the function name to something more similar of what it does.. perhaps AlphasBetweenLastTwoPeriodsInString 🙄

[bcmills]

CC @vdobler @nigeltao

[vdobler]

This is part of a larger class of problems with domain names. This part is the least troublesome as the documentation clearly requires a Domain Name.

[Agronis]

@vdobler you are not wrong, but as I said, if it is acceptable to have validation to ensure the passed string does not contain .. or begins/ends with ., then it's just as reasonable to expect full validation to take place.

Just because you can, doesn't mean you should

The accepted parameter is a string, and the expected output is an eTLD+1.

If the returned output is not as expected but error free, regardless of input, then either the function name, signature or logic is incorrect (imo).