Skip to content

Private ip addresses being validated with public=True #206

Closed
#245
Closed
Private ip addresses being validated with public=True#206
#245
Labels
bugIssue: Works not as designedoutdatedIssue/PR: Open for more than 3 months

Description

@joaonevess
joaonevess
opened on May 6, 2022

https://github.com/kvesteri/validators/blob/4afa24372586aed4930e865d5904eed31013fe81/validators/url.py#L146

There is no guarantee that setting this flag to True will get a "public IP address". A domain might point to private IP addresses, (like vcap.me which points to 127.0.0.1), so trusting public=True could lead to security issues

>>> url("https://127.0.0.1", public=True)
False
>>> url("http://vcap.me", public=True)
True

Activity

  1. danielbraun89 commented on Oct 5, 2022

    @danielbraun89
    danielbraun89
    on Oct 5, 2022

    I agree this kind of validation can be done only after DNS has fully resolved the url

  2. nandgator
    added
    bugIssue: Works not as designed
    outdatedIssue/PR: Open for more than 3 months
    on Mar 14, 2023
  3. nandgator
    added a commit that references this issue on Mar 17, 2023

    maint: improves `url` module

    c43826c
  4. nandgator
    closed this as completedin c43826con Mar 18, 2023
  5. nandgator
    closed this as completedin #245on Mar 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugIssue: Works not as designedoutdatedIssue/PR: Open for more than 3 months

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions