From 504b0a77285eeb9931aec7ccaeddaeb56d3d2c0a Mon Sep 17 00:00:00 2001
From: RaresKeY <158580472+RaresKeY@users.noreply.github.com>
Date: Mon, 20 Jul 2026 08:43:16 +0000
Subject: [PATCH] fix(companion): reject numeric pairing hosts

---
 companion/pairing.py            | 10 ++++++++++
 tests/test_companion_pairing.py |  7 +++++++
 2 files changed, 17 insertions(+)

diff --git a/companion/pairing.py b/companion/pairing.py
index 047a9c543..5fc283804 100644
--- a/companion/pairing.py
+++ b/companion/pairing.py
@@ -50,6 +50,16 @@ def _valid_companion_client_host(host: str) -> bool:
             return False
         if any(label.startswith("xn--") for label in labels):
             return False
+        # WHATWG URL parsers treat a decimal or ``0x`` single-label hostname
+        # as an IPv4 number even though Python's strict ``ipaddress`` parser
+        # rejects that spelling.  The v1 client interpolates this host back
+        # into a URL, so accepting e.g. ``134744072`` would make the phone send
+        # its bearer token to public 8.8.8.8.  Keep DNS labels unambiguous.
+        if len(labels) == 1 and (
+            labels[0].isdigit()
+            or re.fullmatch(r"0x[0-9a-f]*", labels[0]) is not None
+        ):
+            return False
         return len(labels) == 1 or (len(labels) >= 2 and labels[-1] == "local")
 
     return isinstance(address, ipaddress.IPv4Address) and any(
diff --git a/tests/test_companion_pairing.py b/tests/test_companion_pairing.py
index 0e2a8e3ae..006f70602 100644
--- a/tests/test_companion_pairing.py
+++ b/tests/test_companion_pairing.py
@@ -175,6 +175,13 @@ def test_parse_companion_base_url_accepts_v1_client_addresses(value, expected):
         "http://172.32.0.1:7000",
         "http://192.167.255.255:7000",
         "http://192.169.0.1:7000",
+        # WHATWG URL parsing normalizes these legacy numeric host spellings to
+        # IPv4 addresses even though Python's strict ipaddress parser rejects
+        # them.  134744072 / 0x08080808 both become public 8.8.8.8.
+        "http://134744072:7000",
+        "http://0x:7000",
+        "http://0x08080808:7000",
+        "http://017700000001:7000",
         "http://[fd00::1]:7000",
         "http://[fe80::1%25eth0]:7000",
         "http://b\N{LATIN SMALL LETTER U WITH DIAERESIS}cher.local:7000",