News for hackers. Stuff that matters.

A comment on Netmask NPM package, used by 270k+ projects, vulnerable to octal input data. Parent comment

Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by tveita on Monday March 29, 2021 @10:37AM (#26622313)
Interestingly the Python standard library behaves similarly (on Python 3.9.2):

  >>> import ipaddress
  >>> ipaddress.ip_address('010.0.0.1').is_private
  True
Even though the documentation claims that "Leading zeroes are tolerated only for values less than 8 (as there is no ambiguity between the decimal and octal interpretations of such strings)."

https://docs.python.org/3.9/library/ipaddress.html#ipaddress...

[ Parent | on HN ]
Re:Netmask NPM package, used by 270k+ projects, vulnerable t... by qwertox on Monday March 29, 2021 @11:32AM (#26623273)
Same in 3.8. Versions below 3.8 throw a ValueError.

But this is not an issue:

  >>> import ipaddress
  >>> ipaddress.IPv4Address('010.0.0.1')
  IPv4Address('10.0.0.1')
[ Parent | on HN ]