Skip to content

Commit

Permalink
Fix bypass bug with malformed addresses
Browse files Browse the repository at this point in the history
The Ruby Resolv library can return an empty array from getaddresses for
some atypical IP address encodings. This was brought to my attention by
@EdOverflow.
  • Loading branch information
jtdowney committed Nov 5, 2017
1 parent 47b15f6 commit 58a0d7f
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 0 deletions.
2 changes: 2 additions & 0 deletions lib/private_address_check.rb
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ def private_address?(address)

def resolves_to_private_address?(hostname)
ips = Resolv.getaddresses(hostname)
return true if ips.empty?

ips.any? do |ip|
private_address?(ip)
end
Expand Down
4 changes: 4 additions & 0 deletions test/private_address_check_test.rb
Original file line number Diff line number Diff line change
Expand Up @@ -35,4 +35,8 @@ def test_private_hostname_for_public_addresses
def test_private_hostname_for_private_addresses
assert PrivateAddressCheck.resolves_to_private_address?("localhost")
end

def test_private_address_for_malformed_addresses
assert PrivateAddressCheck.resolves_to_private_address?("127.1")
end
end

0 comments on commit 58a0d7f

Please sign in to comment.