Re: Untaint IP address/hostname question

[imcsk8]

if you really want to use a regexp you culd rewrite your current one to look as this one:

(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|(\w+\.)+\w{2,3}$)

[hsinclai]

Not sure that regex above works all that well as an untainter:)... it allows:

999.000.999.000

as an IP address and look what it does to the legal domain name neonutt.firstpart-secondpart.co.uk

Just for your IP addresses (not for your domain names), maybe something like this regex gets closer to what you need?



/((\d | [01]?\d\d | 2[0-4]\d | 25[0-5] )\.){3}(\d | [01]?\d\d | 2[0-4]
+\d | 25[0-5] )/


Do people really test for the binary representation of the address too? I haven't seen it that often... but, then again, I dont' get out often.

-hsinclai

[ambrus]

Not sure that regex above works all that well as an untainter:)... it allows:
999.000.999.000

I disagree. See Re: Untaint IP address/hostname question.

[hsinclai]

If you mean the next program down the line should finally decide whether the IP address is valid, I disagree.

In this situation this regexp should deal with the lower level checking of the basic address validity. 999.000.999.000 is not a valid IP address. Otherwise you're allowing garbage input further down the chain of execution, while you bask in your cerebral interpretation of the definition of "taint" :)


you'll have to check what characters that program accepts.

What program that deals with IP addresses will accept "999.000.999.000" as valid? Do you mean we have drop everything, and go check with that program first?