Uri treats out-of-range IPv4 addresses as valid DNS names.

Open
#111,447 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
csharp
Domain
networking

Research direction

Start by reproducing the Uri constructor case with 300.300.300.300, then read src/libraries/System.Private.Uri/src/System/DomainNameHelper.cs around lines 128-133. Trace how the value is classified as a DNS name and determine the intended validation boundary. Done means out-of-range IPv4-looking values no longer pass as valid DNS names, with regression coverage for the reported case.

Written by the indexing model from the issue text.

Description

area-System.Net 
new Uri("http://300.300.300.300");

doesn't throw and is considered a valid DNS name by the Uri class.

This is because it meets the criteria of a valid domain name, due to dropping the requirement for the first character to be alphabetic:

https://github.com/dotnet/runtime/blob/73bcb1d808e906808f91780aa1af23208549426f/src/libraries/System.Private.Uri/src/System/DomainNameHelper.cs#L128-L133

Perhaps it would make sense to require at least one alphabetic character be present in each label?

Dominant language
C#
Stars
18.3k
Forks
5.6k
PR metrics pending

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dotnet/runtime

All issues in dotnet/runtime

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.