Description
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.
Problem types
CWE-1286: Improper Validation of Syntactic Correctness of Input
Product status
Any version before 1.24.8
1.25.0 (semver) before 1.25.2
Credits
Enze Wang, Jingcheng Yang and Zehui Miao of Tsinghua University
References
groups.google.com/g/golang-announce/c/4Emdl2iQ_bI
