The regular expressions used to identify IP addresses and IP addresses with a netmask (as seen in IPWrapper.isIPorIPList and IPWrapper.getTarget) are too accepting of input related to parsing numbers. The regular expression is defined as:
'\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\/\d{1,2}'
An example input that shows this error is: 999.999.999.999/99
The option re.IGNORECASE is provided as to show case insensitivity. However, this option does nothing as no letters are contained within the expression.
Additionally, the regular expression is not bounded, matching content that has the appearance of an IP address within other content.
An example input that shows this error is: 1.1.1.1/24AAA
In order to validate IPv4 addresses with a netmask in the canonical form, the following regular expression would be more valid:
'^(?:(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5]).){3}(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\/(?:[1-9]|[1-2]\d|3[0-2])$'
The regular expressions used to identify IP addresses and IP addresses with a netmask (as seen in IPWrapper.isIPorIPList and IPWrapper.getTarget) are too accepting of input related to parsing numbers. The regular expression is defined as: '\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\/\d{1,2}' An example input that shows this error is: 999.999.999.999/99
The option re.IGNORECASE is provided as to show case insensitivity. However, this option does nothing as no letters are contained within the expression. Additionally, the regular expression is not bounded, matching content that has the appearance of an IP address within other content.
An example input that shows this error is: 1.1.1.1/24AAA
In order to validate IPv4 addresses with a netmask in the canonical form, the following regular expression would be more valid: '^(?:(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5]).){3}(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\/(?:[1-9]|[1-2]\d|3[0-2])$'