python-ipware 4.1.0__tar.gz → 4.1.1__tar.gz

{python_ipware-4.1.0 → python_ipware-4.1.1}/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 4.1.1
+
+Reported privately by David Gilman.
+
+Harden (modern engine only; legacy is unchanged):
+- A port longer than five significant digits is rejected, same as port `99999`, instead of calling `int()` on an unbounded digit string. A client-controlled header of about 4.3 KB could otherwise make `get_client_ip()` raise `ValueError` (Python's `int` string-digit limit). Zero-padded ports such as `000080` are still accepted.
+- IPv6 zone ids longer than 255 characters are rejected. RFC 4007 sets no maximum; 255 matches the longest common OS interface-name limit so a multi-kilobyte scope is not returned, logged, or stored. The legacy engine still accepts any length.
+
 ## 4.1.0
 
 Best match (modern engine only; legacy is unchanged). Results can differ from 4.0.0 on well-formed input,

{python_ipware-4.1.0 → python_ipware-4.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: python-ipware
-Version: 4.1.0
+Version: 4.1.1
 Summary: A Python package to retrieve a client's real IP address.
 Project-URL: Homepage, https://github.com/un33k/python-ipware
 Project-URL: Documentation, https://github.com/un33k/python-ipware#readme

python_ipware-4.1.1/python_ipware/__version__.py

@@ -0,0 +1 @@
+__version__ = "4.1.1"

{python_ipware-4.1.0 → python_ipware-4.1.1}/python_ipware/modern/parsers.py

@@ -20,6 +20,11 @@ _NAT64_LOCAL = ipaddress.IPv6Network("64:ff9b:1::/48")
 _IPV4_MAPPED = ipaddress.IPv6Network("::ffff:0:0/96")
 # RFC 1122 "this network": never a valid source address.
 _THIS_NETWORK = ipaddress.IPv4Network("0.0.0.0/8")
+# RFC 4007 sets no maximum zone-id length. RFC 9844 §6 asks implementations to
+# apply one, typically the OS interface-name limit (15 on Linux, up to 255 on
+# Windows). 255 stops a multi-kilobyte scope from being logged or stored
+# without rejecting a real interface name.
+_MAX_ZONE_ID_LEN = 255
 
 # How good an address is as a client IP; higher wins. REJECT is never returned.
 TIER_REJECT = 0
@@ -65,7 +70,22 @@ def ip_tier(ip: IpAddressType) -> int:
 
 def _is_port(value: str) -> bool:
     # isascii() guards against Unicode digits such as "²" that isdigit() accepts.
-    return value.isascii() and value.isdigit() and int(value) <= 65535
+    if not (value.isascii() and value.isdigit()):
+        return False
+    # Strip leading zeros, then bound the length before int(): a long digit
+    # string would otherwise exceed sys.get_int_max_str_digits() and raise.
+    digits = value.lstrip("0")
+    return len(digits) <= 5 and int(digits or "0") <= 65535
+
+
+def _zone_id_ok(value: str) -> bool:
+    """False when an IPv6 zone id is longer than ``_MAX_ZONE_ID_LEN``.
+
+    A missing ``%`` is fine. An empty zone (``fe80::1%``) is left to
+    ``ipaddress``, which already rejects it.
+    """
+    _host, sep, zone = value.partition("%")
+    return not sep or len(zone) <= _MAX_ZONE_ID_LEN
 
 
 def strip_port(value: str) -> str:
@@ -155,7 +175,7 @@ def parse_ip(value: Optional[str]) -> Optional[IpAddressType]:
     well-known prefix (``64:ff9b::a.b.c.d``) to the embedded IPv4 client.
     """
     cleaned = clean_ip(value)
-    if not cleaned:
+    if not cleaned or not _zone_id_ok(cleaned):
         return None
     try:
         return unwrap_ipv4(ipaddress.ip_address(cleaned))

{python_ipware-4.1.0 → python_ipware-4.1.1}/tests/tests_router.py

@@ -223,6 +223,78 @@ class TestModernMalformedRejected(unittest.TestCase):
                 self.assertEqual(str(ip), expected)
 
 
+class TestLongPort(unittest.TestCase):
+    """A huge port must be rejected, never raise from int()."""
+
+    def test_long_port_is_rejected_not_raised(self):
+        port = "1" * 5000
+        metas = (
+            {"HTTP_X_FORWARDED_FOR": f"1.2.3.4:{port}"},
+            {"HTTP_X_FORWARDED_FOR": f"[2001:db8::1]:{port}"},
+            {"HTTP_X_FORWARDED_FOR": f":{port}"},
+            {"HTTP_X_FORWARDED_FOR": f"junk:{port}"},
+            {"HTTP_CLIENT_IP": f"1.2.3.4:{port}"},
+            {"HTTP_FORWARDED": f'for="1.2.3.4:{port}"'},
+            {"HTTP_FORWARDED": f'for="[2001:db8::1]:{port}"'},
+            {"REMOTE_ADDR": f"1.2.3.4:{port}"},
+            {"x-forwarded-for": f"1.2.3.4:{port}"},
+        )
+        for meta in metas:
+            for strict in (False, True):
+                with self.subTest(meta=list(meta), strict=strict):
+                    self.assertEqual(IpWare().get_client_ip(meta, strict), (None, False))
+
+    def test_long_port_on_a_later_hop_is_skipped(self):
+        port = "1" * 5000
+        meta = {"HTTP_X_FORWARDED_FOR": f"8.8.8.8, 1.2.3.4:{port}"}
+        ip, trusted = IpWare().get_client_ip(meta)
+        self.assertEqual((str(ip), trusted), ("8.8.8.8", False))
+        self.assertEqual(IpWare().get_client_ip(meta, strict=True), (None, False))
+
+    def test_long_port_with_proxy_options_does_not_raise(self):
+        meta = {"HTTP_X_FORWARDED_FOR": "1.2.3.4:" + "1" * 5000}
+        self.assertEqual(IpWare(proxy_count=1).get_client_ip(meta), (None, False))
+        self.assertEqual(
+            IpWare(proxy_list=["10.0.0.1"]).get_client_ip(meta),
+            (None, False),
+        )
+
+    def test_long_zero_padded_port_is_accepted(self):
+        meta = {"HTTP_X_FORWARDED_FOR": "1.2.3.4:" + "0" * 5000 + "80"}
+        ip, trusted = IpWare().get_client_ip(meta)
+        self.assertEqual(str(ip), "1.2.3.4")
+        self.assertFalse(trusted)
+
+    def test_zero_padded_and_boundary_ports(self):
+        accepted = ("1.2.3.4:000080", "1.2.3.4:65535", "1.2.3.4:0", "[2001:db8::1]:000443")
+        for value in accepted:
+            with self.subTest(value=value):
+                ip, _ = IpWare().get_client_ip({"REMOTE_ADDR": value})
+                self.assertIsNotNone(ip)
+        rejected = ("1.2.3.4:65536", "1.2.3.4:00065536", "1.2.3.4:" + "9" * 4300)
+        for value in rejected:
+            with self.subTest(value=value[:24]):
+                self.assertEqual(IpWare().get_client_ip({"REMOTE_ADDR": value}), (None, False))
+
+
+class TestZoneIdLength(unittest.TestCase):
+    def test_ordinary_zone_id_is_kept(self):
+        ip, _ = IpWare().get_client_ip({"REMOTE_ADDR": "fe80::1%eth0"})
+        self.assertEqual(str(ip), "fe80::1%eth0")
+
+    def test_zone_id_at_cap_is_kept(self):
+        zone = "z" * 255
+        ip, _ = IpWare().get_client_ip({"REMOTE_ADDR": f"fe80::1%{zone}"})
+        self.assertEqual(str(ip), f"fe80::1%{zone}")
+
+    def test_oversized_zone_id_is_rejected(self):
+        zone = "x" * 5000
+        meta = {"HTTP_X_FORWARDED_FOR": f"2606:4700::1111%{zone}"}
+        self.assertEqual(IpWare().get_client_ip(meta), (None, False))
+        bracketed = {"REMOTE_ADDR": f"[fe80::1%{zone}]:80"}
+        self.assertEqual(IpWare().get_client_ip(bracketed), (None, False))
+
+
 class TestModernMetaHardening(unittest.TestCase):
     def test_non_string_values_are_ignored(self):
         for bad in (None, b"1.2.3.4", ["1.2.3.4"], 42):

python_ipware-4.1.0/python_ipware/__version__.py

@@ -1 +0,0 @@
-__version__ = "4.1.0"