(allura) 11/14: [#8603] NonPrivateUrl checks all host=>IP resolutions not just one

[ke...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git

commit 8e96d70099ff566055c1f82f22ea9bae03b80f08
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Wed May 6 12:40:38 2026 -0400

    [#8603] NonPrivateUrl checks all host=>IP resolutions not just one
---
 Allura/allura/lib/validators.py | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/Allura/allura/lib/validators.py b/Allura/allura/lib/validators.py
index e2ceffbba..95e43c219 100644
--- a/Allura/allura/lib/validators.py
+++ b/Allura/allura/lib/validators.py
@@ -61,13 +61,17 @@ def _convert_to_python(self, value, state):
 
         url_components = urlsplit(value)
         try:
-            host_ip = socket.gethostbyname(url_components.hostname)
+            addr_info = socket.getaddrinfo(url_components.hostname, None)
         except socket.gaierror:
             raise fev.Invalid("Invalid URL.", value, state)
-        parse_ip = ip_address(host_ip)
-        if parse_ip and parse_ip.is_private:
-            raise fev.Invalid("Invalid URL.", value, state)
-        self.ip = parse_ip
+
+        for info in addr_info:
+            host_ip = info[4][0]
+            parse_ip = ip_address(host_ip)
+            if parse_ip and parse_ip.is_private:
+                raise fev.Invalid("Invalid URL.", value, state)
+
+        self.ip = ip_address(addr_info[0][4][0])
         return value