When net/http.Client processes a URL with internationalized domain names (IDN) or Unicode characters, it uses different IDNA profiles for resolving the connection target and generating the Host header. This discrepancy can lead to SSRF-filter bypasses when applications rely on url.Hostname() for validation.
Specifically:
• The TCP dial target is computed using idna.Lookup.ToASCII (UTS #46 with mapping), which rewrites Unicode characters to ASCII.
• The Host header is computed using idna.ToASCII (Punycode only, no mapping).
• url.Hostname() returns the raw, unmapped Unicode host.
This allows a client to connect to an IP address (like loopback or metadata endpoint) while announcing a different Host header, bypassing guards that inspect url.Hostname() . For example, a guard that checks url.Hostname() using net.ParseIP() will not recognize fullwidth digits as an IP address, but the dialer will map them to ASCII digits and connect to the IP.
Expected Behavior
The dial target and the Host header should be consistent. Following browser behavior and the WHATWG URL standard, the Host header should contain the case-folded result of UTS #46 compatibility processing.
Actual Behavior
• The request http://１２７．０．０．１/ dials 127.0.0.1 .
• The sent Host header is xn--5g7caagbcfc9b .
• url.Hostname() returns １２７．０．０．１ (which net.ParseIP() does not recognize as a loopback IP).
Examples
The following URLs map to loopback or metadata endpoints upon dialing:
• http://１２７．０．０．１/ dials 127.0.0.1
• http://１６９．２５４．１６９．２５４/ dials 169.254.169.254
• http://169。254。169。254/ dials 169.254.169.254
• http://l<U+200B>ocalhost/ dials localhost
• http://ⓛⓞⓒⓐⓛⓗⓞⓢⓣ/ dials localhost
This was originally reported by Daniele Ballarini.
cc @neild
When net/http.Client processes a URL with internationalized domain names (IDN) or Unicode characters, it uses different IDNA profiles for resolving the connection target and generating the Host header. This discrepancy can lead to SSRF-filter bypasses when applications rely on url.Hostname() for validation.
Specifically:
• The TCP dial target is computed using idna.Lookup.ToASCII (UTS #46 with mapping), which rewrites Unicode characters to ASCII.
• The Host header is computed using idna.ToASCII (Punycode only, no mapping).
• url.Hostname() returns the raw, unmapped Unicode host.
This allows a client to connect to an IP address (like loopback or metadata endpoint) while announcing a different Host header, bypassing guards that inspect url.Hostname() . For example, a guard that checks url.Hostname() using net.ParseIP() will not recognize fullwidth digits as an IP address, but the dialer will map them to ASCII digits and connect to the IP.
Expected Behavior
The dial target and the Host header should be consistent. Following browser behavior and the WHATWG URL standard, the Host header should contain the case-folded result of UTS #46 compatibility processing.
Actual Behavior
• The request http://１２７．０．０．１/ dials 127.0.0.1 .
• The sent Host header is xn--5g7caagbcfc9b .
• url.Hostname() returns １２７．０．０．１ (which net.ParseIP() does not recognize as a loopback IP).
Examples
The following URLs map to loopback or metadata endpoints upon dialing:
• http://１２７．０．０．１/ dials 127.0.0.1
• http://１６９．２５４．１６９．２５４/ dials 169.254.169.254
• http://169。254。169。254/ dials 169.254.169.254
• http://l<U+200B>ocalhost/ dials localhost
• http://ⓛⓞⓒⓐⓛⓗⓞⓢⓣ/ dials localhost
This was originally reported by Daniele Ballarini.
cc @neild