IPMatcher: Strip IPv6 zone

[hansott]

No description provided.

[aikido-pr-checks]

🔵 Low - IPv6 zone stripping accepts malformed addresses with no address before %

The new zone handling truncates end after checking start == end, so an input such as %eth0:: or [%eth0::] leaves an empty address portion and then parseIPv6 returns success through the no-compression path, producing the all-zero address. IPMatcher.matches consequently treats this malformed string as ::, so an IP allowlist or other IP list containing ::/128 (or a broader IPv6 range) can accept a non-IP value; the private-IP detector instead fails closed by classifying it as private. The same first-percent truncation also silently accepts additional zone separators and malformed text after an incomplete address.

Show fix

Suggested change

	if (start == end) {
	return false;
	}
	int zoneSeparator = indexOf(value, '%', start, end);
	if (zoneSeparator >= 0) {
	if (zoneSeparator == end - 1) {
	return false;
	}
	end = zoneSeparator;
	}
	if (end - start == 2 && value.charAt(start) == ':' && value.charAt(start + 1) == ':') {
	return true;
	}
	int zoneSeparator = indexOf(value, '%', start, end);
	if (zoneSeparator >= 0) {
	if (zoneSeparator == start || zoneSeparator == end - 1) {
	return false;
	}
	if (indexOf(value, '%', zoneSeparator + 1, end) >= 0) {
	return false;
	}
	end = zoneSeparator;
	}
	if (start == end) {
	return false;
	}
	if (end - start == 2 && value.charAt(start) == ':' && value.charAt(start + 1) == ':') {

_{More info - Reply on this comment to give feedback or ignore the issue.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!