Severity: MEDIUM
Location: src/Controllers/BbsListingController.php:572-574
Bug: Naive explode(':') mangles IPv6.
Fix: Use the same bracket-aware regex the promote parser uses.
Status: open. Will reply with remediation details when resolved.
[M-9] IPv6 addresses mis-parsed in connectToken community path
Resolved.
Resolved as part of the C-6 fix. The community branch of connectToken (src/Controllers/BbsListingController.php:560+) now uses the same IPv6-bracket-aware regex as promoteToFeatured:
if (preg_match('/^\[([0-9a-fA-F:]+)\](?::(\d+))?$/', $rawUrl, $m)) {
$host = $m[1]; $port = (int) ($m[2] ?? 23);
} elseif (preg_match('/^([^\s:]+)(?::(\d+))?$/', $rawUrl, $m)) {
$host = $m[1]; $port = (int) ($m[2] ?? 23);
}
IPv6 addresses like [2001:db8::1]:23 now parse correctly. See thread #1662 (C-6) for the full change context.
Locking this thread.