Repository navigation
Honor AI_NUMERICHOST in Socket.getaddrinfo - #9801
Open
sampokuokkanen wants to merge 1 commit into
Open
sampokuokkanen wants to merge 1 commit into
sampokuokkanen wants to merge 1 commit into
Conversation
The flag was ignored, so a host name went to InetAddress.getAllByName and was resolved through DNS instead of raising SocketError. Code that uses AI_NUMERICHOST to tell address literals from names (surfguard's SSRF guard, for one) then treated resolved names as literals. Only IPv6 and decimal IPv4 literals are accepted with the flag now, before any lookup.
kares
approved these changes
Oct 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The flag was ignored, so a host name went to InetAddress.getAllByName and was resolved through DNS instead of raising SocketError. Code that uses AI_NUMERICHOST to tell address literals from names (surfguard's SSRF guard, for one) then treated resolved names as literals. Only IPv6 and decimal IPv4 literals are accepted with the flag now, before any lookup.
The added specs pass on MRI, this was found when running ONCE Campfile on JRuby. https://github.com/basecamp/once-campfire/blob/05c5a2c0d72f7fd74d7c2ace23cc123000f956b9/lib/restricted_http/private_network_guard.rb#L20-L23 this bug is hit inside the Surfguard gem.