ipv6 validation does not allow all ipv6 variantions #771

New Issue

2025-11-13T12:10:26-06:00

GiteaMirror commented

2025-11-13 12:10:26 -06:00

Originally created by @LaurenceJJones on GitHub (Nov 11, 2025).

https://github.com/fosrl/pangolin/blob/d38b321f85ffdf7fc2ea22ed0f4d518d3baed12c/server/lib/validators.ts#L88

The regex here is expecting a full 8-hextet IPv6 only. It wont allow these other variants of ipv6:

::1 (loopback, compressed)
2001:db8::1 (compressed zeros)
fe80::1%eth0 (zone ID)
::ffff:192.0.2.128 (IPv4-mapped)

Either we should expand the regex to handle all cases or switch over to ipaddr.js library for a more "battle tested" library but up to you!

Originally created by @LaurenceJJones on GitHub (Nov 11, 2025). https://github.com/fosrl/pangolin/blob/d38b321f85ffdf7fc2ea22ed0f4d518d3baed12c/server/lib/validators.ts#L88 The regex here is expecting a full 8-hextet IPv6 only. It wont allow these other variants of ipv6: ``` ::1 (loopback, compressed) 2001:db8::1 (compressed zeros) fe80::1%eth0 (zone ID) ::ffff:192.0.2.128 (IPv4-mapped) ``` Either we should expand the regex to handle all cases or switch over to ipaddr.js library for a more "battle tested" library but up to you!

GiteaMirror commented

2025-11-13 12:10:26 -06:00

@AstralDestiny commented on GitHub (Nov 11, 2025):

Something like
/^(([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:)|([0-9A-Fa-f]{1,4}:){1,7}:|([0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,5}(:[0-9A-Fa-f]{1,4}){1,2}|([0-9A-Fa-f]{1,4}:){1,4}(:[0-9A-Fa-f]{1,4}){1,3}|([0-9A-Fa-f]{1,4}:){1,3}(:[0-9A-Fa-f]{1,4}){1,4}|([0-9A-Fa-f]{1,4}:){1,2}(:[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:((:[0-9A-Fa-f]{1,4}){1,6})|:((:[0-9A-Fa-f]{1,4}){1,7}|:))$/

But that only covers full, compressed..

/^\[?((([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,7}:|([0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,5}(:[0-9A-Fa-f]{1,4}){1,2}|([0-9A-Fa-f]{1,4}:){1,4}(:[0-9A-Fa-f]{1,4}){1,3}|([0-9A-Fa-f]{1,4}:){1,3}(:[0-9A-Fa-f]{1,4}){1,4}|([0-9A-Fa-f]{1,4}:){1,2}(:[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(:[0-9A-Fa-f]{1,4}){1,6}|:((:[0-9A-Fa-f]{1,4}){1,7}|:)|(([0-9A-Fa-f]{1,4}:){6,6}|::ffff(:0{1,4}){0,1}:|64:ff9b:(:[0-9A-Fa-f]{1,4}){0,4}:)((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)))(%[0-9A-Za-z_.-]+)?\]?$/

Might do it, Might be missing some stuff but should be valid for the all valid entries for v6 but I might've missed some, but about to pass out, Thanks for remembering <3

@AstralDestiny commented on GitHub (Nov 11, 2025): Something like `/^(([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:)|([0-9A-Fa-f]{1,4}:){1,7}:|([0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,5}(:[0-9A-Fa-f]{1,4}){1,2}|([0-9A-Fa-f]{1,4}:){1,4}(:[0-9A-Fa-f]{1,4}){1,3}|([0-9A-Fa-f]{1,4}:){1,3}(:[0-9A-Fa-f]{1,4}){1,4}|([0-9A-Fa-f]{1,4}:){1,2}(:[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:((:[0-9A-Fa-f]{1,4}){1,6})|:((:[0-9A-Fa-f]{1,4}){1,7}|:))$/` But that only covers full, compressed.. `/^\[?((([0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,7}:|([0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|([0-9A-Fa-f]{1,4}:){1,5}(:[0-9A-Fa-f]{1,4}){1,2}|([0-9A-Fa-f]{1,4}:){1,4}(:[0-9A-Fa-f]{1,4}){1,3}|([0-9A-Fa-f]{1,4}:){1,3}(:[0-9A-Fa-f]{1,4}){1,4}|([0-9A-Fa-f]{1,4}:){1,2}(:[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(:[0-9A-Fa-f]{1,4}){1,6}|:((:[0-9A-Fa-f]{1,4}){1,7}|:)|(([0-9A-Fa-f]{1,4}:){6,6}|::ffff(:0{1,4}){0,1}:|64:ff9b:(:[0-9A-Fa-f]{1,4}){0,4}:)((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)))(%[0-9A-Za-z_.-]+)?\]?$/ ` Might do it, Might be missing some stuff but should be valid for the all valid entries for v6 but I might've missed some, but about to pass out, Thanks for remembering <3