From 294009014d74a883112f13dbf48b7403ca79b012 Mon Sep 17 00:00:00 2001 From: "Danilo M." Date: Tue, 8 Sep 2026 15:25:22 +0200 Subject: fix: re-bracket an IPv6 host when stripping URL userinfo parts.hostname returns an IPv6 literal WITHOUT its brackets (2001:db8::1, not [2001:db8::1]), and _netloc_without_userinfo reassembled f"{host}:{port}" directly from it: redact.url("http://victim@[2001:db8::1]:8080/p?x=1") -> "http://2001:db8::1:8080/p?x=REDACTED" That string is not parseable back into a host and a port, and the digits after the second-to-last colon are not even part of the address any more. Reporting it means the abuse desk cannot identify the host at all, or misreads it, which is the same class of harm as reporting a wrong IP outright. _netloc_without_userinfo re-adds brackets whenever the hostname contains ":", so an IPv6 host now survives userinfo stripping exactly as an IPv4 or named host already did. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R --- tests/test_redact.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'tests/test_redact.py') diff --git a/tests/test_redact.py b/tests/test_redact.py index e6d65c0..553ffec 100644 --- a/tests/test_redact.py +++ b/tests/test_redact.py @@ -65,6 +65,18 @@ class TestRedactUrl(unittest.TestCase): "http://a.invalid/p#REDACTED", ) + def test_an_ipv6_host_survives_userinfo_stripping(self): + self.assertEqual( + redact.url("http://victim@[2001:db8::1]:8080/p?x=1"), + "http://[2001:db8::1]:8080/p?x=REDACTED", + ) + + def test_an_ipv6_host_without_userinfo_is_untouched(self): + self.assertEqual( + redact.url("http://[2001:db8::1]:8080/p?x=1"), + "http://[2001:db8::1]:8080/p?x=REDACTED", + ) + class TestSuspectPathSegments(unittest.TestCase): def test_a_base64_looking_segment_is_flagged(self): -- cgit v1.2.3