From e7f6a95e21ba7fcf882cc889e287d3fb69c997c3 Mon Sep 17 00:00:00 2001
From: Yu-ga <74749461+yuga-hashimoto@users.noreply.github.com>
Date: Sun, 5 Apr 2026 21:34:47 +0900
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20Fix=20incom?=
 =?UTF-8?q?plete=20IPv4=20validation=20in=20NetworkUtils=20(#452)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes incomplete IPv4 validation - adds bounds checking for p3 and p4 octets to prevent edge-case bypasses like '192.168.evil.com'.
---
 .../java/com/openclaw/assistant/shared/utils/NetworkUtils.kt  | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/shared/src/main/java/com/openclaw/assistant/shared/utils/NetworkUtils.kt b/shared/src/main/java/com/openclaw/assistant/shared/utils/NetworkUtils.kt
index e7a07f8..7bcaf61 100644
--- a/shared/src/main/java/com/openclaw/assistant/shared/utils/NetworkUtils.kt
+++ b/shared/src/main/java/com/openclaw/assistant/shared/utils/NetworkUtils.kt
@@ -34,6 +34,10 @@ object NetworkUtils {
         if (ipv4Parts.size == 4) {
             val p1 = ipv4Parts[0].toIntOrNull() ?: return false
             val p2 = ipv4Parts[1].toIntOrNull() ?: return false
+            val p3 = ipv4Parts[2].toIntOrNull() ?: return false
+            val p4 = ipv4Parts[3].toIntOrNull() ?: return false
+
+            if (p1 !in 0..255 || p2 !in 0..255 || p3 !in 0..255 || p4 !in 0..255) return false
 
             if (p1 == 127) return true // Loopback: 127.x.x.x
             if (p1 == 10) return true  // Class A Private: 10.x.x.x