Ex: Re: AccessByIPAddress with IPv6 addresses

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Monday, October 19, 2020 12:14 PM
> 
> I am 99% sure Jetty fixed this on the branch
[...]
> I guess I considered the whole thing closed once Jetty fixed their code. I
> really did not think it was a 10.x thing. That would seem to be something
> needing confirmation.

I would love to be proven wrong :).

Evidence at hand:

* I'm running jetty-9.4.32.v20200930, the latest released version, there are brackets in the address

* The STRIP_IPV6 parameter was originally added in commit:
        https://github.com/eclipse/jetty.project/commit/55ee9279e1e92ff7707cbce06a832d0d1fd2bab2
   which updated the file jetty-util/src/main/java/org/eclipse/jetty/util/HostPort.java

* If you look at the upstream jetty repo:
       https://github.com/eclipse/jetty.project
   and select the tag jetty-9.4.32.v20200930, and navigate to that file:
       https://github.com/eclipse/jetty.project/blob/jetty-9.4.32.v20200930/jetty-util/src/main/java/org/eclipse/jetty/util/HostPort.java
   there's absolutely no mention of that configuration parameter

> would be a really great way to open a hole in the access control because once
> you start allowing "other stuff" it's super-common to come up with exploits
> you don't expect.

Eeeehhhhh... I get your point, but you are not accepting random garbage that somebody typed by accident. You are accepting an RFC compliant variant of the address format, one that evidently is parsed successfully by the default java InetAddress implementation, but not the Google one.

At least for now, I would like to get it working pending a longer-term proper resolution of the issue. Given I am already compiling the idp anyway to backport a few things, adding this code to it seems a lot simpler than twiddling with a jetty filter :).

If (ipstring.startsWith("[") && ipstring.endsWith("]")) {
	ipstring = (ipstring.substring(1, ipstring.length() - 1));
}