IPv6 handling bug in starlette.datastructures.URL

[dimaqq]

URL uses stdlib urlsplit to parse the string URL,

however, it uses this code to recombine the host and port.

            netloc = hostname                                                           
            if port is not None:                                                        
                netloc += f":{port}"  

Consider an IPv6 URL, like http://[::1]:8080/

• urlsplit will strip the quare brackets and produce ::1
• manual concatenation will yield ::1:8080
• which is not a valid netloc

[dimaqq]

MRE

In [5]: import starlette.datastructures

In [6]: starlette.datastructures.URL("https://[fe::2]:12345").replace(port=42)
Out[6]: URL('https://fe::2:42')

[dimaqq]

@Kludex I think good-first-issue tag would apply here 🙏🏻

[Kludex]

Ok 👀

So... If it's too complicated, it's on @dimaqq 👀

[kousikmitra]

Hi @Kludex I have raised a PR for this #1965, This is my first PR in this repo so do let me know if I missed anything.

[brycefisher]

@kousikmitra thanks for your fix PR!! Looks like you might need to pull in recent changes from the main branch.

@Kludex any other feedback you have for @kousikmitra? I'd love to get this fix merged and brought into FastAPI for my own project. Thanks everyone for all your contributions!

[Kludex]

This was solved on #1965, and it will be available on Starlette 0.24.0.