import 'dart:io';
void main() {
const String normalIp = '123.1.1.1';
print(Uri.parseIPv4Address(normalIp));
print(InternetAddress.tryParse(normalIp));
// Output
// [123, 1, 1, 1]
// InternetAddress('123.1.1.1', IPv4)
final String lotsOfLeadingZeroesIp = '${'0' * 10_000_000}123.1.1.1';
print(Uri.parseIPv4Address(lotsOfLeadingZeroesIp));
print(InternetAddress.tryParse(lotsOfLeadingZeroesIp));
// Output
// [123, 1, 1, 1]
// null
}
Passing a IPv4 string with a large number of leading zeroes in any of the octets to Uri.parseIPv4Address would lead to long parsing time and high memory usage. This may be a security concern. Uri.parseIPv6Address is also affected (for the trailing IPv4 part of the IPv6 address).
InternetAddress.tryParse however rejects leading zeroes and is not affected.
Should Uri.parseIPv4Address be changed to match the behavior of InternetAddress.tryParse? It may affect users who use it to parse IPv4 addresses in octal form.
Tested on Dart 3.9.0 (stable) on "linux_x64"
Passing a IPv4 string with a large number of leading zeroes in any of the octets to
Uri.parseIPv4Addresswould lead to long parsing time and high memory usage. This may be a security concern.Uri.parseIPv6Addressis also affected (for the trailing IPv4 part of the IPv6 address).InternetAddress.tryParsehowever rejects leading zeroes and is not affected.Should
Uri.parseIPv4Addressbe changed to match the behavior ofInternetAddress.tryParse? It may affect users who use it to parse IPv4 addresses in octal form.Tested on Dart 3.9.0 (stable) on "linux_x64"