Skip to content

Safer ServerName extraction in the dialer#192

Merged
NGTmeaty merged 2 commits into
internetarchive:masterfrom
vbanos:dialer-sec-fix
May 12, 2026
Merged

Safer ServerName extraction in the dialer#192
NGTmeaty merged 2 commits into
internetarchive:masterfrom
vbanos:dialer-sec-fix

Conversation

@vbanos

@vbanos vbanos commented May 8, 2026

Copy link
Copy Markdown
Contributor

Issue: dialer.go derived ServerName via string slicing (address[:LastIndex(":")]), which is wrong for IPv6 and can mis-handle malformed addresses. Fix: use net.SplitHostPort when possible.

Issue: dialer.go derived ServerName via string slicing (`address[:LastIndex(":")]`),
which is wrong for IPv6 and can mis-handle malformed addresses.
Fix: use `net.SplitHostPort` when possible.
@vbanos

vbanos commented May 8, 2026

Copy link
Copy Markdown
Contributor Author

AI also suggested using extra param: MinVersion: tls.VersionTLS12 in the same function to increase security.
I'm not sure we want this because we'll have issues archiving hosts with depreceted SSL configs.

@NGTmeaty NGTmeaty left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch on the IPv6 addresses!

Handle error when extracting host from address.
@NGTmeaty NGTmeaty merged commit 25a2ce6 into internetarchive:master May 12, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants