Fix IPAddress & Uri octal parsing inconsistencies (#121962)

MihaZupan · web-flow · commit 20901cbc4ab0 · 2025-11-26T19:44:23.000+01:00
diff --git a/src/libraries/Common/src/System/Net/IPv4AddressHelper.Common.cs b/src/libraries/Common/src/System/Net/IPv4AddressHelper.Common.cs
@@ -133,7 +133,6 @@ internal static bool IsValidCanonical<TChar>(ReadOnlySpan<TChar> name, out int e
             int dots = 0;
             long number = 0;
             bool haveNumber = false;
-            bool firstCharIsZero = false;
             int start = 0;
 
             while (start < name.Length)
@@ -161,16 +160,11 @@ internal static bool IsValidCanonical<TChar>(ReadOnlySpan<TChar> name, out int e
 
                 if (parsedCharacter < IPv4AddressHelper.Decimal)
                 {
-                    // A number starting with zero should be interpreted in base 8 / octal
-                    if (!haveNumber && parsedCharacter == 0)
+                    if (!haveNumber && parsedCharacter == 0 &&
+                        (uint)(start + 1) < (uint)name.Length && char.IsAsciiDigit((char)ToUShort(name[start + 1])))
                     {
-                        if ((start + 1 < name.Length) && name[start + 1] == TChar.CreateTruncating('0'))
-                        {
-                            // 00 is not allowed as a prefix.
-                            return false;
-                        }
-
-                        firstCharIsZero = true;
+                        // Octal is not allowed in canonical format.
+                        return false;
                     }
 
                     haveNumber = true;
@@ -184,15 +178,14 @@ internal static bool IsValidCanonical<TChar>(ReadOnlySpan<TChar> name, out int e
                 {
                     // If the current character is not an integer, it may be the IPv4 component separator ('.')
 
-                    if (!haveNumber || (number > 0 && firstCharIsZero))
+                    if (!haveNumber)
                     {
-                        // 0 is not allowed to prefix a number.
                         return false;
                     }
+
                     ++dots;
                     haveNumber = false;
                     number = 0;
-                    firstCharIsZero = false;
                 }
                 else
                 {
diff --git a/src/libraries/System.Net.Primitives/tests/FunctionalTests/IPAddressParsing.cs b/src/libraries/System.Net.Primitives/tests/FunctionalTests/IPAddressParsing.cs
@@ -264,6 +264,8 @@ public void ParseIPv4_ValidAddress_Success(string address, string expected)
             new object[] { "12.+1.1.4" }, // plus sign in section
             new object[] { "12.1.-1.5" }, // minus sign in section
             new object[] { "12.1.abc.5" }, // text in section
+            new object[] { "0.0.0.089" }, // octal with digits over 7
+            new object[] { "0.0.08.0" }, // octal with digits over 7
         };
 
         public static readonly object[][] InvalidIpv4AddressesStandalone = // but valid as part of IPv6 addresses
@@ -438,7 +440,6 @@ public void ParseIPv4_InvalidAddress_ThrowsFormatExceptionWithInnerException(str
             new object[] { "::FFFF:0:192.168.0.1", "::ffff:0:192.168.0.1" }, // SIIT
             new object[] { "::5EFE:192.168.0.1", "::5efe:192.168.0.1" }, // ISATAP
             new object[] { "1::5EFE:192.168.0.1", "1::5efe:192.168.0.1" }, // ISATAP
-            new object[] { "::192.168.0.010", "::192.168.0.10" }, // Embedded IPv4 octal, read as decimal
         };
 
         [Theory]
@@ -570,6 +571,9 @@ public static IEnumerable<object[]> InvalidIpv6Addresses()
             yield return new object[] { ":%12" }; // colon scope
             yield return new object[] { "[2001:0db8:85a3:08d3:1319:8a2e:0370:7344]:443/" }; // errneous ending slash after ignored port
 
+            yield return new object[] { "::192.168.01.10" }; // Embedded IPv4 with octal
+            yield return new object[] { "::192.168.0.010" }; // Embedded IPv4 with octal
+
             yield return new object[] { "e3fff:ffff:ffff:ffff:ffff:ffff:ffff:abcd" }; // 1st number too long
             yield return new object[] { "3fff:effff:ffff:ffff:ffff:ffff:ffff:abcd" }; // 2nd number too long
             yield return new object[] { "3fff:ffff:effff:ffff:ffff:ffff:ffff:abcd" }; // 3rd number too long
diff --git a/src/libraries/System.Net.Primitives/tests/FunctionalTests/IPEndPointParsing.cs b/src/libraries/System.Net.Primitives/tests/FunctionalTests/IPEndPointParsing.cs
@@ -301,7 +301,6 @@ private void InvalidPortHelper(string addressAndPort)
             new object[] { "::FFFF:0:192.168.0.1", "::ffff:0:192.168.0.1" }, // SIIT
             new object[] { "::5EFE:192.168.0.1", "::5efe:192.168.0.1" }, // ISATAP
             new object[] { "1::5EFE:192.168.0.1", "1::5efe:192.168.0.1" }, // ISATAP
-            new object[] { "::192.168.0.010", "::192.168.0.10" }, // Embedded IPv4 octal, read as decimal
         };
 
         public static readonly object[][] ValidIpv4Andv6AddressesWithAndWithoutPort =
diff --git a/src/libraries/System.Private.Uri/tests/FunctionalTests/UriIpHostTest.cs b/src/libraries/System.Private.Uri/tests/FunctionalTests/UriIpHostTest.cs
@@ -219,6 +219,11 @@ private void ParseBadIPv4Address(string badIpv4String)
             {
                 Assert.NotEqual(UriHostNameType.IPv4, testUri.HostNameType);
             }
+
+            if (Uri.TryCreate($"custom://{badIpv4String}/", UriKind.Absolute, out testUri))
+            {
+                Assert.NotEqual(UriHostNameType.IPv4, testUri.HostNameType);
+            }
         }
 
         #endregion Helpers
@@ -314,7 +319,6 @@ public void UriIPv6Host_ScopeId_Success(string address)
         [InlineData("::FFFF:0:192.168.0.1", "::ffff:0:192.168.0.1")] // SIIT
         [InlineData("::5EFE:192.168.0.1", "::5efe:192.168.0.1")] // ISATAP
         [InlineData("1::5EFE:192.168.0.1", "1::5efe:192.168.0.1")] // ISATAP
-        [InlineData("::192.168.0.010", "::192.168.0.10")] // Embedded IPv4 octal, read as decimal
         public void UriIPv6Host_EmbeddedIPv4_Success(string address, string expected)
         {
             ParseIPv6Address(address, expected);
@@ -461,6 +465,7 @@ private void ParseBadIPv6Address(string badIpv6String)
 
             // TryCreate
             Assert.False(Uri.TryCreate($"http://[{badIpv6String}]/", UriKind.Absolute, out _), badIpv6String);
+            Assert.False(Uri.TryCreate($"custom://[{badIpv6String}]/", UriKind.Absolute, out _), badIpv6String);
         }
 
         #endregion Helpers

Original file line number	Diff line number	Diff line change
`@@ -133,7 +133,6 @@ internal static bool IsValidCanonical<TChar>(ReadOnlySpan<TChar> name, out int e`
`133`	`133`	`int dots = 0;`
`134`	`134`	`long number = 0;`
`135`	`135`	`bool haveNumber = false;`
`136`		`- bool firstCharIsZero = false;`
`137`	`136`	`int start = 0;`
`138`	`137`
`139`	`138`	`while (start < name.Length)`
`@@ -161,16 +160,11 @@ internal static bool IsValidCanonical<TChar>(ReadOnlySpan<TChar> name, out int e`
`161`	`160`
`162`	`161`	`if (parsedCharacter < IPv4AddressHelper.Decimal)`
`163`	`162`	`{`
`164`		`- // A number starting with zero should be interpreted in base 8 / octal`
`165`		`- if (!haveNumber && parsedCharacter == 0)`
	`163`	`+ if (!haveNumber && parsedCharacter == 0 &&`
	`164`	`+ (uint)(start + 1) < (uint)name.Length && char.IsAsciiDigit((char)ToUShort(name[start + 1])))`
`166`	`165`	`{`
`167`		`- if ((start + 1 < name.Length) && name[start + 1] == TChar.CreateTruncating('0'))`
`168`		`- {`
`169`		`- // 00 is not allowed as a prefix.`
`170`		`- return false;`
`171`		`- }`
`172`		`-`
`173`		`- firstCharIsZero = true;`
	`166`	`+ // Octal is not allowed in canonical format.`
	`167`	`+ return false;`
`174`	`168`	`}`
`175`	`169`
`176`	`170`	`haveNumber = true;`
`@@ -184,15 +178,14 @@ internal static bool IsValidCanonical<TChar>(ReadOnlySpan<TChar> name, out int e`
`184`	`178`	`{`
`185`	`179`	`// If the current character is not an integer, it may be the IPv4 component separator ('.')`
`186`	`180`
`187`		`- if (!haveNumber \|\| (number > 0 && firstCharIsZero))`
	`181`	`+ if (!haveNumber)`
`188`	`182`	`{`
`189`		`- // 0 is not allowed to prefix a number.`
`190`	`183`	`return false;`
`191`	`184`	`}`
	`185`	`+`
`192`	`186`	`++dots;`
`193`	`187`	`haveNumber = false;`
`194`	`188`	`number = 0;`
`195`		`- firstCharIsZero = false;`
`196`	`189`	`}`
`197`	`190`	`else`
`198`	`191`	`{`
Original file line number	Diff line number	Diff line change
`@@ -219,6 +219,11 @@ private void ParseBadIPv4Address(string badIpv4String)`
`219`	`219`	`{`
`220`	`220`	`Assert.NotEqual(UriHostNameType.IPv4, testUri.HostNameType);`
`221`	`221`	`}`
	`222`	`+`
	`223`	`+ if (Uri.TryCreate($"custom://{badIpv4String}/", UriKind.Absolute, out testUri))`
	`224`	`+ {`
	`225`	`+ Assert.NotEqual(UriHostNameType.IPv4, testUri.HostNameType);`
	`226`	`+ }`
`222`	`227`	`}`
`223`	`228`
`224`	`229`	`#endregion Helpers`
`@@ -314,7 +319,6 @@ public void UriIPv6Host_ScopeId_Success(string address)`
`314`	`319`	`[InlineData("::FFFF:0:192.168.0.1", "::ffff:0:192.168.0.1")] // SIIT`
`315`	`320`	`[InlineData("::5EFE:192.168.0.1", "::5efe:192.168.0.1")] // ISATAP`
`316`	`321`	`[InlineData("1::5EFE:192.168.0.1", "1::5efe:192.168.0.1")] // ISATAP`
`317`		`- [InlineData("::192.168.0.010", "::192.168.0.10")] // Embedded IPv4 octal, read as decimal`
`318`	`322`	`public void UriIPv6Host_EmbeddedIPv4_Success(string address, string expected)`
`319`	`323`	`{`
`320`	`324`	`ParseIPv6Address(address, expected);`
`@@ -461,6 +465,7 @@ private void ParseBadIPv6Address(string badIpv6String)`
`461`	`465`
`462`	`466`	`// TryCreate`
`463`	`467`	`Assert.False(Uri.TryCreate($"http://[{badIpv6String}]/", UriKind.Absolute, out _), badIpv6String);`
	`468`	`+ Assert.False(Uri.TryCreate($"custom://[{badIpv6String}]/", UriKind.Absolute, out _), badIpv6String);`
`464`	`469`	`}`
`465`	`470`
`466`	`471`	`#endregion Helpers`