jakartaee / jakartaee/mail-api

Error in check for hexadecimal numbers

Open Beginner friendly
#592 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
285
Forks
109
Avg merge
15h 19m
Merged PRs (30d)
1

Description

**Describe the bug**

The static method `jakarta.mail.internet.InternetAddress.isInetAddressLiteral` accepts all the characters `a-z` as well as `A-Z` as hexadecimal characters when determining if a given string is an IPv4 or IPv6 address literal or not. The correct way to check for an hexadecimal letter would be to check for numbers in the ranges `a-f` and `A-F`.

https://github.com/eclipse-ee4j/mail/blob/master/api/src/main/java/jakarta/mail/internet/InternetAddress.java#L687

The method is not intended to be exact w.r.t. to formatting and correctness of the given adresses, but the actual behavior is not according to the description, and wrong.

**To Reproduce**

Call the above-mentioned method with for instance the string:

`"2001:THIS:IS:NOT:IPv6:ffff:ffff:ffff"` and see that it returns the value `true`, which is not correct.

**Expected behavior**

The method should only return true for (case insensitive) hexadecimal numbers, when given an IPv6 string.

The behavior does not effect IPv4 strings, since they cannot contain letters and the method would return a correct answer.

I can not see any particular security issue with the bug, but the behavior is still clearly not correct.

A correct row 687 would be

`else if ((c >= 'a' && c <= 'f') || (c >= 'A' && c <= 'F'))`

Contributor guide

Open the contributing guide

Research direction

Open api/src/main/java/jakarta/mail/internet/InternetAddress.java around line 687 and inspect isInetAddressLiteral. Reproduce the issue with "2001:THIS:IS:NOT:IPv6:ffff:ffff:ffff" and compare its result with the expected IPv6 validation behavior. Done means alphabetic hexadecimal checks accept only a-f and A-F while IPv4 behavior remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.