{"text":"@ryanc I trust it that you personally considered everything with your own IP parsing library but really: this is bad general advise. The trouble starts when your library processes that \u201ccursed inet_aton nonsense\u201d and passes it on to something that actually uses inet_aton or similar logic. And then your security checks are no longer valid because what you considered a DNS-resolvable host name is treated as an IP address further along the line, or what you considered decimal numbers is treated as octal. I\u2019ve seen vulnerabilities due to such parser mismatches and avoiding them is very tricky.","truncated":false,"created_at":"Thu Apr 24 08:36:29 +0900 2025","in_reply_to_status_id":"9681272","uri":"https:\/\/infosec.exchange\/users\/WPalant\/statuses\/114389902028403900","source":"ActivityPub","source_link":null,"id":9683722,"in_reply_to_user_id":174285,"in_reply_to_screen_name":"ryanc","geo":null,"user":{"id":164735,"name":"Wladimir Palant","screen_name":"WPalant","location":null,"description":"Software developer and security researcher, browser extensions expert. \/ searchable#infosec #cybersecurty #cryptography #privacy","profile_image_url":"https:\/\/gnusocial.jp\/avatar\/164735-48-20260106114703.webp","profile_image_url_https":"https:\/\/gnusocial.jp\/avatar\/164735-48-20260106114703.webp","profile_image_url_profile_size":"https:\/\/gnusocial.jp\/avatar\/164735-96-20260107000155.webp","profile_image_url_original":"https:\/\/gnusocial.jp\/avatar\/164735-original-tmp20260104222030.webp","groups_count":0,"linkcolor":false,"backgroundcolor":false,"url":null,"protected":false,"followers_count":0,"friends_count":0,"created_at":"Tue Aug 29 22:42:52 +0900 2023","utc_offset":"0","time_zone":"UTC","statuses_count":29,"following":false,"statusnet_blocking":false,"notifications":false,"statusnet_profile_url":"https:\/\/infosec.exchange\/@WPalant","cover_photo":false,"background_image":false,"profile_link_color":false,"profile_background_color":false,"profile_banner_url":false,"is_local":false,"is_silenced":false,"rights":{"delete_user":false,"delete_others_notice":false,"silence":false,"sandbox":false},"is_sandboxed":false,"favourites_count":0},"statusnet_html":"<p><a href=\"https:\/\/infosec.exchange\/@ryanc\" class=\"u-url mention\">@ryanc<\/a> I trust it that you personally considered everything with your own IP parsing library but really: this is bad general advise. The trouble starts when your library processes that \u201ccursed inet_aton nonsense\u201d and passes it on to something that actually uses inet_aton or similar logic. And then your security checks are no longer valid because what you considered a DNS-resolvable host name is treated as an IP address further along the line, or what you considered decimal numbers is treated as octal. I\u2019ve seen vulnerabilities due to such parser mismatches and avoiding them is very tricky.<\/p>","statusnet_conversation_id":4941083,"statusnet_in_groups":false,"external_url":"https:\/\/gnusocial.jp\/notice\/9683722","in_reply_to_profileurl":"https:\/\/infosec.exchange\/@ryanc","in_reply_to_ostatus_uri":"https:\/\/infosec.exchange\/users\/ryanc","attentions":[{"id":174285,"screen_name":"ryanc","fullname":"Ryan Castellucci (they\/them) :nonbinary_flag:","profileurl":"https:\/\/infosec.exchange\/@ryanc","ostatus_uri":"https:\/\/infosec.exchange\/users\/ryanc"}],"fave_num":0,"repeat_num":0,"is_post_verb":true,"is_local":false,"favorited":false,"repeated":false}