Sanitize the hostname and port number returned via DNS

lib/Libravatar/URL.pm

@@ -197,6 +197,19 @@ sub build_url {
     return $url;
 }
 
+sub sanitize_target {
+    my ( $target, $port ) = @_;
+
+    unless ( $target =~ m/^[0-9a-zA-Z\-.]+$/ ) {
+        return ( undef, undef );
+    }
+    unless ( $port =~ m/^[0-9]{1,5}$/ ) {
+        return ( undef, undef );
+    }
+
+    return ( $target, $port )
+}
+
 sub federated_url {
     my %args = @_;
 
@@ -215,7 +228,7 @@ sub federated_url {
     my $packet = $fast_resolver->query($srv_prefix . '._tcp.' . $domain, 'SRV');
 
     if ( $packet and $packet->answer ) {
-        my ( $target, $port ) = srv_hostname($packet->answer);
+        my ( $target, $port ) = sanitize_target(srv_hostname($packet->answer));
         return build_url($target, $port, $args{https});
     }
     return undef;