Skip to content

Reject non-ASCII digits at the start of an InternetDomainName TLD - #8749

Open
insaf021 wants to merge 1 commit into
google:masterfrom
insaf021:idn-nonascii-digit-tld
Open

insaf021 wants to merge 1 commit into
google:masterfrom
insaf021:idn-nonascii-digit-tld

Conversation

@insaf021

Copy link
Copy Markdown
Contributor

On master:

InternetDomainName.isValid("127.0.0.1")   // true
InetAddresses.isInetAddress("127.0.0.1")      // true
IDN.toASCII("127.0.0.1")                    // "127.0.0.1"

validatePart relies on the final label not starting with a digit to keep IPv4 literals from validating as domain names, but it only checks ASCII 0-9. InetAddresses accepts any Unicode decimal digit (as its Javadoc notes), so fullwidth or Arabic-Indic forms of an address such as 10.0.0.١ are accepted by both classes. Code that uses InternetDomainName to decide that a host is a name rather than an IP literal can be handed an address, and IDNA-aware clients map the fullwidth form back to 127.0.0.1.

Character.isDigit covers the same digits that InetAddresses accepts. Under GWT it only recognizes ASCII digits, so GWT behavior stays the same and the new test is @GwtIncompatible. The android/ copy is left to the mirroring script, as described in CONTRIBUTING.md.

validatePart relies on the final label not starting with a digit to keep
IPv4 literals from validating as domain names, but it checked for ASCII
0-9 only. InetAddresses accepts any Unicode decimal digit, so a fullwidth
"127.0.0.1" passed both InternetDomainName.isValid and
InetAddresses.isInetAddress.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates InternetDomainName.java to use Character.isDigit instead of DIGIT_MATCHER.matches when validating the final part of a domain name. This ensures that non-ASCII digits (such as fullwidth or Arabic-Indic digits) are correctly identified, preventing IPv4-like addresses using these characters from being incorrectly validated as domain names. Corresponding unit tests have been added in InternetDomainNameTest.java to verify this behavior. There are no review comments, and I have no additional feedback to provide.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant