On: Netmask NPM package, used by 270k+ projects, vulnerable to octal input data

[tveita]

Interestingly the Python standard library behaves similarly (on Python 3.9.2):

  >>> import ipaddress
  >>> ipaddress.ip_address('010.0.0.1').is_private
  True

Even though the documentation claims that "Leading zeroes are tolerated only for values less than 8 (as there is no ambiguity between the decimal and octal interpretations of such strings)."

https://docs.python.org/3.9/library/ipaddress.html#ipaddress...

[qwertox → tveita]

Same in 3.8. Versions below 3.8 throw a ValueError.

But this is not an issue:

  >>> import ipaddress
  >>> ipaddress.IPv4Address('010.0.0.1')
  IPv4Address('10.0.0.1')