|
 |
60a024 |
diff --git a/Doc/library/ipaddress.rst b/Doc/library/ipaddress.rst
|
|
|
60a024 |
index 2cdfddb..d464d2a 100644
|
|
|
60a024 |
--- a/Doc/library/ipaddress.rst
|
|
|
60a024 |
+++ b/Doc/library/ipaddress.rst
|
|
|
60a024 |
@@ -104,8 +104,7 @@ write code that handles both IP versions correctly. Address objects are
|
|
|
60a024 |
1. A string in decimal-dot notation, consisting of four decimal integers in
|
|
|
60a024 |
the inclusive range 0--255, separated by dots (e.g. ``192.168.0.1``). Each
|
|
|
60a024 |
integer represents an octet (byte) in the address. Leading zeroes are
|
|
|
60a024 |
- tolerated only for values less than 8 (as there is no ambiguity
|
|
|
60a024 |
- between the decimal and octal interpretations of such strings).
|
|
|
60a024 |
+ not tolerated to prevent confusion with octal notation.
|
|
|
60a024 |
2. An integer that fits into 32 bits.
|
|
|
60a024 |
3. An integer packed into a :class:`bytes` object of length 4 (most
|
|
|
60a024 |
significant octet first).
|
|
|
60a024 |
diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
|
|
|
60a024 |
index 28b7b61..d351f07 100644
|
|
|
60a024 |
--- a/Lib/ipaddress.py
|
|
|
60a024 |
+++ b/Lib/ipaddress.py
|
|
|
60a024 |
@@ -1173,6 +1173,11 @@ class _BaseV4:
|
|
|
60a024 |
if len(octet_str) > 3:
|
|
|
60a024 |
msg = "At most 3 characters permitted in %r"
|
|
|
60a024 |
raise ValueError(msg % octet_str)
|
|
|
60a024 |
+ # Handle leading zeros as strict as glibc's inet_pton()
|
|
|
60a024 |
+ # See security bug bpo-36384
|
|
|
60a024 |
+ if octet_str != '0' and octet_str[0] == '0':
|
|
|
60a024 |
+ msg = "Leading zeros are not permitted in %r"
|
|
|
60a024 |
+ raise ValueError(msg % octet_str)
|
|
|
60a024 |
# Convert to integer (we know digits are legal)
|
|
|
60a024 |
octet_int = int(octet_str, 10)
|
|
|
60a024 |
if octet_int > 255:
|
|
|
60a024 |
diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
|
|
|
60a024 |
index 2f1c5b6..1297b83 100644
|
|
|
60a024 |
--- a/Lib/test/test_ipaddress.py
|
|
|
60a024 |
+++ b/Lib/test/test_ipaddress.py
|
|
|
60a024 |
@@ -97,10 +97,23 @@ class CommonTestMixin:
|
|
|
60a024 |
class CommonTestMixin_v4(CommonTestMixin):
|
|
|
60a024 |
|
|
|
60a024 |
def test_leading_zeros(self):
|
|
|
60a024 |
- self.assertInstancesEqual("000.000.000.000", "0.0.0.0")
|
|
|
60a024 |
- self.assertInstancesEqual("192.168.000.001", "192.168.0.1")
|
|
|
60a024 |
- self.assertInstancesEqual("016.016.016.016", "16.16.16.16")
|
|
|
60a024 |
- self.assertInstancesEqual("001.000.008.016", "1.0.8.16")
|
|
|
60a024 |
+ # bpo-36384: no leading zeros to avoid ambiguity with octal notation
|
|
|
60a024 |
+ msg = "Leading zeros are not permitted in '\d+'"
|
|
|
60a024 |
+ addresses = [
|
|
|
60a024 |
+ "000.000.000.000",
|
|
|
60a024 |
+ "192.168.000.001",
|
|
|
60a024 |
+ "016.016.016.016",
|
|
|
60a024 |
+ "192.168.000.001",
|
|
|
60a024 |
+ "001.000.008.016",
|
|
|
60a024 |
+ "01.2.3.40",
|
|
|
60a024 |
+ "1.02.3.40",
|
|
|
60a024 |
+ "1.2.03.40",
|
|
|
60a024 |
+ "1.2.3.040",
|
|
|
60a024 |
+ ]
|
|
|
60a024 |
+ for address in addresses:
|
|
|
60a024 |
+ with self.subTest(address=address):
|
|
|
60a024 |
+ with self.assertAddressError(msg):
|
|
|
60a024 |
+ self.factory(address)
|
|
|
60a024 |
|
|
|
60a024 |
def test_int(self):
|
|
|
60a024 |
self.assertInstancesEqual(0, "0.0.0.0")
|