Ticket #41083: 41083.8.diff

src/wp-admin/includes/class-wp-community-events.php

@@ -279 +279 @@
 
                 if ( $is_ipv6 ) {
                         // IPv6 addresses will always be enclosed in [] if there's a port.
-                        $ip_start = 1;
-                        $ip_end   = (int) strpos( $client_ip, ']' ) - 1;
+                        $left_bracket  = strpos( $client_ip, '[' );
+                        $right_bracket = strpos( $client_ip, ']' );
                         $netmask  = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
 
                         // Strip the port (and [] from IPv6 addresses), if they exist.
-                        if ( $ip_end > 0 ) {
-                                $client_ip = substr( $client_ip, $ip_start, $ip_end );
-                        }
+                        if ( false !== $left_bracket && false !== $right_bracket ) {
+                                $client_ip = substr( $client_ip, $left_bracket + 1, $right_bracket - $left_bracket - 1 );
+                        } elseif ( false !== $left_bracket || false !== $right_bracket ) {
+                                // The IP has one bracket, but not both, so it's malformed.
+                                return false;
+                        } // elseif it has any invalid chars (not digit, colon, bracket, letter, %, maybe others)
+                                // then return false?
 
                         // Partially anonymize the IP by reducing it to the corresponding network ID.
                         if ( function_exists( 'inet_pton' ) && function_exists( 'inet_ntop' ) ) {

tests/phpunit/tests/admin/includesCommunityEvents.php

@@ -284 +284 @@
                                 'unknown',
                                 false,
                         ),
+                        // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001',
+                                false,
+                        ),
+                        // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                'or=\"1000:0000:0000:0000:0000:0000:0000:0001',
+                                false,
+                        ),
+                        // Invalid IP. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                '1000:0000:0000:0000:0000:0000:0000:0001or=\"',
+                                false,
+                        ),
+                        // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001]:400',
+                                '1000::',
+                        ),
+                        // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001]',
+                                '1000::',
+                        ),
+                        // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                'or=\"[1000:0000:0000:0000:0000:0000:0000:0001]400',
+                                '1000::',
+                        ),
+                        // Malformed string with valid IP substring. Sometimes proxies add things like this, or other arbitrary strings.
+                        array(
+                                '[1000:0000:0000:0000:0000:0000:0000:0001]:235\"or=',
+                                '1000::',
+                        ),
                         // IPv4, no port
                         array(
                                 '10.20.30.45',
@@ -364 +399 @@
                                 '[::127.0.0.1]:30000',
                                 '::ffff:127.0.0.0',
                         ),
+                        // IPv6 with reachability scope
+                        array(
+                                'fe80::b059:65f4:e877:c40%16',
+                                'fe80::'
+                        ),
+                        // IPv6 with reachability scope
+                        array(
+                                'fe80::b059:65f4:e877:c40%eth0',
+                                'fe80::'
+                        ),
                 );
         }
 }