Repository navigation
port() accepts non-numeric values, which can change the host #203
Description
URI::_server::port() (via _port) appends the new value to the authority without checking it. If the value has an @, the authority is parsed differently afterwards and host() returns another host.
my $u = URI->new("https://api.good.example/v1/hook");
$u->port("443\@evil.example");
say $u; # https://api.good.example:443@evil.example/v1/hook
say $u->host; # evil.example
say $u->userinfo; # api.good.example:443Expected: the host stays api.good.example. port() should reject a value that isn't all digits (or percent-encode it), the same way host() escapes @ (s/[@]/%40/g; # protect @ in _server.pm).
Seen with URI 5.37.
Possibly related: #70 (out-of-range numeric ports).
🤖 Generated with Claude Code · Opus 5.5
Activity