From 9e8f8498c1441625ad34c11559f943ef4497b5f8 Mon Sep 17 00:00:00 2001
From: jazelly <xzha4350@gmail.com>
Date: Thu, 22 Aug 2024 22:54:35 +0930
Subject: [PATCH] net: validate host name for server listen

Fixes: https://github.com/nodejs/node/issues/54441

Co-authored-by: Luigi Pinca <luigipinca@gmail.com>
---
 lib/net.js                                      |  8 ++++++++
 test/parallel/test-net-server-listen-options.js | 12 ++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/lib/net.js b/lib/net.js
index 4de6f9c5f6f23a..ab44e2be9f18ae 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -35,6 +35,8 @@ const {
   NumberParseInt,
   ObjectDefineProperty,
   ObjectSetPrototypeOf,
+  RegExp,
+  RegExpPrototypeExec,
   Symbol,
   SymbolAsyncDispose,
   SymbolDispose,
@@ -142,6 +144,8 @@ const { kTimeout } = require('internal/timers');
 const DEFAULT_IPV4_ADDR = '0.0.0.0';
 const DEFAULT_IPV6_ADDR = '::';
 
+const HOST_REGEXP = new RegExp('^[a-zA-Z0-9-:%.]+$');
+
 const noop = () => {};
 
 const kPerfHooksNetConnectContext = Symbol('kPerfHooksNetConnectContext');
@@ -2019,6 +2023,10 @@ Server.prototype.listen = function(...args) {
     toNumber(args.length > 2 && args[2]);  // (port, host, backlog)
 
   options = options._handle || options.handle || options;
+  if (typeof options.host === 'string' && RegExpPrototypeExec(HOST_REGEXP, options.host) === null) {
+    throw new ERR_INVALID_ARG_VALUE('host', options.host);
+  }
+
   const flags = getFlags(options.ipv6Only);
   //  Refresh the id to make the previous call invalid
   this._listeningId++;
diff --git a/test/parallel/test-net-server-listen-options.js b/test/parallel/test-net-server-listen-options.js
index 7e306af8ab082f..cec081430cf504 100644
--- a/test/parallel/test-net-server-listen-options.js
+++ b/test/parallel/test-net-server-listen-options.js
@@ -15,6 +15,10 @@ function close() { this.close(); }
   // Test listen({port})
   net.createServer().listen({ port: 0 })
     .on('listening', common.mustCall(close));
+  // Test listen(host, port}) on ipv4
+  net.createServer().listen({ host: '127.0.0.1', port: '3000' }).on('listening', common.mustCall(close));
+  // Test listen(host, port}) on ipv6
+  net.createServer().listen({ host: '::', port: '3001' }).on('listening', common.mustCall(close));
 }
 
 // Test listen(port, cb) and listen({ port }, cb) combinations
@@ -66,6 +70,13 @@ const listenOnPort = [
                       name: 'TypeError',
                       message: /^The argument 'options' must have the property "port" or "path"\. Received .+$/,
                     });
+    } else if (typeof options.host === 'string' && !options.host.match(/^[a-zA-Z0-9-:%.]+$/)) {
+      assert.throws(fn,
+                    {
+                      code: 'ERR_INVALID_ARG_VALUE',
+                      name: 'TypeError',
+                      message: /^The argument 'host' is invalid\. Received .+$/,
+                    });
     } else {
       assert.throws(fn,
                     {
@@ -91,4 +102,5 @@ const listenOnPort = [
   shouldFailToListen({ host: 'localhost:3000' });
   shouldFailToListen({ host: { port: 3000 } });
   shouldFailToListen({ exclusive: true });
+  shouldFailToListen({ host: '[::]', port: 3000 });
 }