erabo/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-08-05 02:45:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(companion): reject numeric pairing hosts

Browse source
This commit is contained in:
RaresKeY 2026-07-20 08:43:16 +00:00
parent b7b418ce36
commit 504b0a7728
2 changed files with 17 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
companion/pairing.py
View file

@ -50,6 +50,16 @@ def _valid_companion_client_host(host: str) -> bool:
return False
if any(label.startswith("xn--") for label in labels):
return False
# WHATWG URL parsers treat a decimal or ``0x`` single-label hostname
# as an IPv4 number even though Python's strict ``ipaddress`` parser
# rejects that spelling. The v1 client interpolates this host back
# into a URL, so accepting e.g. ``134744072`` would make the phone send
# its bearer token to public 8.8.8.8. Keep DNS labels unambiguous.
if len(labels) == 1 and (
labels[0].isdigit()
or re.fullmatch(r"0x[0-9a-f]*", labels[0]) is not None
):
return False
return len(labels) == 1 or (len(labels) >= 2 and labels[-1] == "local")
return isinstance(address, ipaddress.IPv4Address) and any(

7
tests/test_companion_pairing.py
View file

@ -175,6 +175,13 @@ def test_parse_companion_base_url_accepts_v1_client_addresses(value, expected):
"http://172.32.0.1:7000",
"http://192.167.255.255:7000",
"http://192.169.0.1:7000",
# WHATWG URL parsing normalizes these legacy numeric host spellings to
# IPv4 addresses even though Python's strict ipaddress parser rejects
# them. 134744072 / 0x08080808 both become public 8.8.8.8.
"http://134744072:7000",
"http://0x:7000",
"http://0x08080808:7000",
"http://017700000001:7000",
"http://[fd00::1]:7000",
"http://[fe80::1%25eth0]:7000",
"http://b\N{LATIN SMALL LETTER U WITH DIAERESIS}cher.local:7000",