Skip to content

Phone Number matches incorrectly - #257

Closed
HamiedAsadi wants to merge 20 commits into
bee-san:mainfrom
Croquembouche:main
Closed

HamiedAsadi wants to merge 20 commits into
bee-san:mainfrom
Croquembouche:main

Conversation

@HamiedAsadi

Copy link
Copy Markdown

⚠ Pull Requests not made with this template will be automatically closed 🔥

Prerequisites

Why do we need this pull request?

  • Explain the why behind your PR. We can see what it does from the code. But why does it do that?

What GitHub issues does this fix?

  • Fixes #10000

Copy / paste of output

Please copy and paste the output of PyWhat with your new addition using an example that tests this addition below:

bee-san added a commit to nexiouscaliver/pyWhat that referenced this pull request Oct 1, 2026
* Prefix the IPv6 regex with (?i) so upper-case hex digits match
  (2001:DB8::1, FE80::1, ...). Previously only lower-case groups (plus a
  stray [0-9a-fA] typo) were accepted. This is the fix proposed in bee-san#267.
* Revert the port group back to decimal digits: ports are decimal, and
  [2001:db8::1]:808a must not be identified as IP:port.
* Add upper-case Valid examples (from bee-san#257) and a hex-port Invalid
  example; flip the hex-port test accordingly and add an upper-case test.
* Drop docs/ipv6_fix_explanation.md: it described the regex incorrectly
  and the repository has no docs/ directory.

Co-authored-by: Renzy Armstrong <Renzyvizloten@gmail.com>
Co-authored-by: hyihua <hyihua@wayne.edu>
bee-san added a commit that referenced this pull request Oct 1, 2026
* fix: update IPv6 regex to support hexadecimal characters

Updated IPv6 regex pattern ::[0-9] to ::[0-9a-fA-F]
to support hexadecimal digits (0-9, a-f, A-F) in IPv6 shorthand notation.

This fixes the main issue where '::' alone was matching as an IPv6 address.
After this fix:
- '::' correctly does NOT match
- '::1' correctly matches (single digit)
- '::ffff', '::dead:beef', '::cafe' should match but currently don't

Note: The regex structure is complex and there appear to be additional
issues with multi-digit hexadecimal shorthand matching. Further investigation
may be needed to fully support all IPv6 shorthand formats.

Fixes: #201

* test: add IPv6 regex tests for issue #201

Added test cases to verify that:
- '::' alone is correctly rejected (issue #201)
- Valid IPv6 addresses like '::1' are matched
- Compressed IPv6 addresses work correctly
- Full IPv6 addresses are matched
- Invalid formats are rejected

These tests ensure the fix for issue #201 (IPv6 matching on '::')
continues to work correctly.

* docs: add :: to IPv6 Invalid examples

Added '::' to the Invalid examples list for IPv6 regex pattern.
This documents the expected behavior for issue #201, where '::'
alone should NOT be matched as an IPv6 address.

This helps prevent regression and clarifies the expected behavior
for developers and users.

* docs: add more valid IPv6 examples

Added common compressed IPv6 address formats to Valid examples:
- ::1 (loopback shorthand)
- fe80::1 (link-local)
- 2001:db8::1 (documentation prefix)

These examples demonstrate proper IPv6 shorthand notation
and help verify the regex correctly handles compressed formats.

* test: add IPv6 regex test to verify fix works correctly

* docs: add IPv6 fix explanation

Documented the IPv6 regex fix for issue #201:
- Explained the root cause (optional :: group)
- Described the solution (changed [0-9] to [0-9a-fA-F])
- Listed what changed and test results
- Added notes about multi-digit hex shorthand edge cases

* fix: resolve SonarCloud quality gate issues

- Remove root-level test_ipv6_fix.py scratch script (SonarCloud
  pythonsecurity:S2631 critical vulnerability: regex constructed from
  user-controlled data, plus python:S1313 hardcoded-IP smells). Its
  import was broken and its unique cases are now covered in
  tests/test_ipv6.py.
- tests/test_ipv6.py: filter matches by 'IPv6' tag instead of Name
  substring (entry name is 'Internet Protocol (IP) Address Version 6',
  which does not contain 'IPv6'), add hex-port test, add NOSONAR
  suppressions for intentional documentation IP literals (python:S1313).
- docs/ipv6_fix_explanation.md: point to tests/test_ipv6.py instead of
  the removed scratch script.

* fix: shrink regex.json diff to surgical IPv6-only patch (Sonar round 2)

The previous commits included a whole-file reformat of regex.json, which
made every line 'new code' to SonarCloud and dragged pre-existing PEM
private-key example strings into the PR gate as BLOCKER secrets:S6706
findings (new_security_rating = 5).

Restore the file to upstream bytes and re-apply only the IPv6 entry
changes:
- port group [0-9]{1,5} -> [0-9a-fA-F]{1,5} (hex port support)
- Valid examples: add ::1, fe80::1, 2001:db8::1
- Invalid examples: add :: (issue #201)

Diff vs upstream is now 11 lines, scoped entirely to the IPv6 entry.
All 423 tests pass.

* docs: clarify hex-port behavior of the updated IPv6 regex

* Make IPv6 regex case-insensitive; keep ports decimal

* Prefix the IPv6 regex with (?i) so upper-case hex digits match
  (2001:DB8::1, FE80::1, ...). Previously only lower-case groups (plus a
  stray [0-9a-fA] typo) were accepted. This is the fix proposed in #267.
* Revert the port group back to decimal digits: ports are decimal, and
  [2001:db8::1]:808a must not be identified as IP:port.
* Add upper-case Valid examples (from #257) and a hex-port Invalid
  example; flip the hex-port test accordingly and add an upper-case test.
* Drop docs/ipv6_fix_explanation.md: it described the regex incorrectly
  and the repository has no docs/ directory.

Co-authored-by: Renzy Armstrong <Renzyvizloten@gmail.com>
Co-authored-by: hyihua <hyihua@wayne.edu>

---------

Co-authored-by: nexiouscaliver <nexiouscaliver@users.noreply.github.com>
Co-authored-by: Autumn Skerritt <github@skerritt.blog>
Co-authored-by: Renzy Armstrong <Renzyvizloten@gmail.com>
Co-authored-by: hyihua <hyihua@wayne.edu>
@bee-san

bee-san commented Oct 1, 2026

Copy link
Copy Markdown
Owner

Thanks @HamiedAsadi, @hyihua, @qchiujunhao and @Croquembouche! The IPv6 part of this PR (the upper-case hex examples, ffff::/::ffff, and :: as an invalid example) overlapped with #266/#267. It was combined into #266 and merged (618f30d), with @hyihua credited as co-author.

I'm closing this draft rather than merging the rest. As it stands it would break the package:

  • pyproject.toml is deleted, and the pywhat.* imports were changed to top-level import helper / from filter import .... Neither pip install pywhat nor python -m pywhat would work.
  • __main__.py now starts a PyQt6 GUI instead of the CLI, and PyQt6 isn't a dependency.
  • The query-history recorder writes record.csv inside the installed package and prints extra lines on every run. A stray out.dat and a second CI workflow are also included.
  • Despite the title, nothing here changes phone-number matching, so Phone Number matches incorrectly #240 stays open.

A GUI or query history would be welcome as separate, focused PRs: keep the pywhat.* imports, make PyQt6 an optional extra, and store history in a user data directory.

@bee-san bee-san closed this Oct 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants