jakartaee / jakartaee/mail-api
Error in check for hexadecimal numbers
- Dominant language
- Java
- Stars
- 285
- Forks
- 109
- Avg merge
- 15h 19m
- Merged PRs (30d)
- 1
Description
**Describe the bug**
The static method `jakarta.mail.internet.InternetAddress.isInetAddressLiteral` accepts all the characters `a-z` as well as `A-Z` as hexadecimal characters when determining if a given string is an IPv4 or IPv6 address literal or not. The correct way to check for an hexadecimal letter would be to check for numbers in the ranges `a-f` and `A-F`.
https://github.com/eclipse-ee4j/mail/blob/master/api/src/main/java/jakarta/mail/internet/InternetAddress.java#L687
The method is not intended to be exact w.r.t. to formatting and correctness of the given adresses, but the actual behavior is not according to the description, and wrong.
**To Reproduce**
Call the above-mentioned method with for instance the string:
`"2001:THIS:IS:NOT:IPv6:ffff:ffff:ffff"` and see that it returns the value `true`, which is not correct.
**Expected behavior**
The method should only return true for (case insensitive) hexadecimal numbers, when given an IPv6 string.
The behavior does not effect IPv4 strings, since they cannot contain letters and the method would return a correct answer.
I can not see any particular security issue with the bug, but the behavior is still clearly not correct.
A correct row 687 would be
`else if ((c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F'))`
Contributor guide
Research direction
Open api/src/main/java/jakarta/mail/internet/InternetAddress.java around line 687 and inspect isInetAddressLiteral. Reproduce the issue with "2001:THIS:IS:NOT:IPv6:ffff:ffff:ffff" and compare its result with the expected IPv6 validation behavior. Done means alphabetic hexadecimal checks accept only a-f and A-F while IPv4 behavior remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100