Commit 326d19a
src: resolve TODO related to inspector CVEs
This was not done before the security release because the latest CVE was
not known at the time.
PR-URL: #45341
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>1 parent 0deed8d commit 326d19a
1 file changed
Lines changed: 3 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -162,11 +162,10 @@ static std::string TrimPort(const std::string& host) { | |||
| 162 | 162 | } | |
| 163 | 163 | ||
| 164 | 164 | static bool IsIPAddress(const std::string& host) { | |
| 165 | - // TODO(tniessen): add CVEs to the following bullet points | ||
| 166 | 165 | // To avoid DNS rebinding attacks, we are aware of the following requirements: | |
| 167 | - // * the host name must be an IP address, | ||
| 168 | - // * the IP address must be routable, and | ||
| 169 | - // * the IP address must be formatted unambiguously. | ||
| 166 | + // * the host name must be an IP address (CVE-2018-7160, CVE-2022-32212), | ||
| 167 | + // * the IP address must be routable (hackerone.com/reports/1632921), and | ||
| 168 | + // * the IP address must be formatted unambiguously (CVE-2022-43548). | ||
| 170 | 169 | ||
| 171 | 170 | // The logic below assumes that the string is null-terminated, so ensure that | |
| 172 | 171 | // we did not somehow end up with null characters within the string. | |
0 commit comments