5 ms·

Javascript seems to normalize these automatically: const a = document.createElement('a'); a.href = 'http://032166163360'; console.log(a.href);

Javascript seems to normalize these automatically: const a = document.createElement('a'); a.href = 'http://032166163360'; console.log(a.href); // "http://209.216.230.240/" a.href = 'http://127.1' console.log(a.href); // "http://127.0.0.1/" a.href = 'http://10.50.1' console.log(a.href); // "http://10.50.0.1/" a.href = 'http://10.0.513' console.log(a.href); // "http://10.0.2.1/" a.href = 'http://0xA000201' console.log(a.href); // "http://10.0.2.1/" a.href = 'http://10.0.2.010' console.log(a.href); // "http://10.0.2.8/" and also: console.log(new URL('http://10.0.513').host) // "10.0.2.1"

rwalle 3y ago
I think you mean browser (more specifically HTML standard), not JavaScript
- LegionMammal978 3y ago
  In particular, IPv4 address parsing for URL hosts is specified in https://url.spec.whatwg.org/#concept-ipv4-parser https://url.spec.whatwg.org/#concept-ipv4-parser, in WHATWG's URL Standard.
geraldcombs 3y ago
It (and most other scripting languages) are likely just calling inet_aton under the hood.
- tinglymintyfrsh 3y ago
  And proper inet_aton allows even more formats (IPv4 only): u32 undotted u8.u24 dotted-signal u8.u8.u16 dotted-triple u8.u8.u8.u8 dotted-quad ^ where each of the above is allowed to be octal, hex, or decimal
lucb1e 3y ago
This wasn't always the case. For years, my website had a numeric vhost configured with an easter egg but I don't think anyone ever visited it. Then I noticed, maybe four years ago, that firefox now translates the IP address into dotted quad notation and use that as a Host header instead of what the user typed, so it would never trigger now anyway. The internet used to be more fun when it was all fun and games and we didn't need to worry about every possible type of user misleading :(
- rep_lodsb 3y ago
  >The internet used to be more fun when it was all fun and games and we didn't need to worry about every possible type of user misleading :( I remember in the 2000s, there was some site using a decimal IP address (as a single number, not dotted quad) that had hacking/crypto puzzles. Something with a "Alice in Wonderland" theme. Does that ring a bell for anyone?
  - hyperdimension 3y ago
    > I remember in the 2000s, there was some site using a decimal IP address (as a single number, not dotted quad) that had hacking/crypto puzzles. Something with a "Alice in Wonderland" theme. Does that ring a bell for anyone? Was it called ninebows? I was looking online for that a while ago to show a friend, and I remember in school reading pages and pages of forum threads about it: speculation of what this or that meant, ideas for solving the next puzzle, et c. It was a website with some hidden puzzle that, once solved, would leave you with another link somewhere else with another puzzle that needed solving. Someone eventually won, too, but it looks like it just vanished off the face of the Internet like many things from that era. Either that, or my search engine skills aren't good enough.

rwalle 3y ago

I think you mean browser (more specifically HTML standard), not JavaScript

LegionMammal978 3y ago
In particular, IPv4 address parsing for URL hosts is specified in https://url.spec.whatwg.org/#concept-ipv4-parser https://url.spec.whatwg.org/#concept-ipv4-parser, in WHATWG's URL Standard.

geraldcombs 3y ago

It (and most other scripting languages) are likely just calling inet_aton under the hood.

tinglymintyfrsh 3y ago
And proper inet_aton allows even more formats (IPv4 only): u32 undotted u8.u24 dotted-signal u8.u8.u16 dotted-triple u8.u8.u8.u8 dotted-quad ^ where each of the above is allowed to be octal, hex, or decimal

lucb1e 3y ago

This wasn't always the case. For years, my website had a numeric vhost configured with an easter egg but I don't think anyone ever visited it. Then I noticed, maybe four years ago, that firefox now translates the IP address into dotted quad notation and use that as a Host header instead of what the user typed, so it would never trigger now anyway. The internet used to be more fun when it was all fun and games and we didn't need to worry about every possible type of user misleading :(

rep_lodsb 3y ago
>The internet used to be more fun when it was all fun and games and we didn't need to worry about every possible type of user misleading :( I remember in the 2000s, there was some site using a decimal IP address (as a single number, not dotted quad) that had hacking/crypto puzzles. Something with a "Alice in Wonderland" theme. Does that ring a bell for anyone?
- hyperdimension 3y ago
  > I remember in the 2000s, there was some site using a decimal IP address (as a single number, not dotted quad) that had hacking/crypto puzzles. Something with a "Alice in Wonderland" theme. Does that ring a bell for anyone? Was it called ninebows? I was looking online for that a while ago to show a friend, and I remember in school reading pages and pages of forum threads about it: speculation of what this or that meant, ideas for solving the next puzzle, et c. It was a website with some hidden puzzle that, once solved, would leave you with another link somewhere else with another puzzle that needed solving. Someone eventually won, too, but it looks like it just vanished off the face of the Internet like many things from that era. Either that, or my search engine skills aren't good enough.