Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lib: use Node.js net lib and reject malformed addresses #144

Open
wants to merge 6 commits into
base: main
Choose a base branch
from

Conversation

ouuan
Copy link

@ouuan ouuan commented Feb 21, 2024

See #143. Given the current API of this library, I believe that it's not suitable to support malformed addresses like 0x7f.1. It's hard to parse them correctly in all cases. It's better to throw errors for them.

This PR uses the Node.js net library so it should be reliable.

I suggest releasing v3 after merging this, because:

  1. net.SocketAddress is added in Node v15.14.0 and v14.18.0. I think it's reasonable to drop support for older Node versions because Node 12 has reached end-of-life since 2022-04-30. If the user cares about security, they should use a new Node version.
  2. I would consider throwing new errors as a breaking change.
  3. Dropping support for malformed addresses could also be a breaking change.

We could try to (partially) fix the security concerns in a compatible way in v2 (and v1) in another pull request.

@abhishek-parative
Copy link

Is this getting merged in?

@ouuan
Copy link
Author

ouuan commented Mar 6, 2024

The maintainer is very inactive. He has no obligation to continue maintaining this library, but I'd suggest switching to a different actively maintained library.

@abhishek-parative
Copy link

@indutny Can you please review/merge this PR?

lib/ip.js Show resolved Hide resolved
lib/ip.js Show resolved Hide resolved
@sfc-gh-ksaket
Copy link

Is this PR getting merged?

@rdebeasi
Copy link

rdebeasi commented Aug 1, 2024

I came across a couple of maintained forks of node-ip:

Both forks are a few months old, so there's not enough activity for me to tell whether they're likely to be maintained in the long term. That said, they may be a good solution for folks who aren't yet ready to switch to an alternative.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants