Skip to content

fix: validate malformed IPv6 zone identifiers - #213

Open
Tony133 wants to merge 2 commits into
mainfrom
fix/ipv6-zone-identifier-validation
Open

fix: validate malformed IPv6 zone identifiers#213
Tony133 wants to merge 2 commits into
mainfrom
fix/ipv6-zone-identifier-validation

Conversation

@Tony133

@Tony133 Tony133 commented Aug 22, 2026

Copy link
Copy Markdown
Member

Proposal:

Fix malformed IPv6 zone identifier handling in bracketed IP literals.

When parsing IPv6 zone identifiers, malformed values such as:

  • fe80::1%25
  • fe80::1%25eth 0
  • fe80::1%25eth%ZZ
  • fe80::1%25K

must be rejected rather than silently rewritten.

This is particularly relevant on Node.js 16, where the native URL parser can truncate these values instead of reporting an invalid host.

Changes:

  • Validate IPv6 zone identifiers explicitly in normalizeIPv6().
  • Reject empty, whitespace-containing and malformed percent-encoded zone identifiers.
  • Preserve the original malformed host instead of truncating or rewriting it.
  • Add regression tests for valid and malformed IPv6 zone identifiers.

Note:

Screenshot 2026-08-22 alle 12 12 39

@Tony133
Tony133 marked this pull request as ready for review August 22, 2026 10:16
@Tony133
Tony133 requested a review from mcollina August 22, 2026 10:16
@mcollina

Copy link
Copy Markdown
Member

@Tony133 oops, this now conflicts. PTAL.

Signed-off-by: Antonio Tripodi <Tony133@users.noreply.github.com>
@Tony133

Tony133 commented Aug 23, 2026

Copy link
Copy Markdown
Member Author

@mcollina conflicts resolved ✅ 👀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants