VBC-901: hardcoded-ip-v4

warning

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .go, .java, .json, .env, .astro
Scope: string and template literals only
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/testdata/**, **/fixtures/**, **/test_*.py, **/*_test.py, **/test.py, **/conftest.py, **/*_test.go, **/*_bench.go, **/*.test.*, **/*.spec.*, **/bench/**, **/benchmark*, **/*corpus*, **/*payload*
Tags: security

What it reports

Hardcoded IP address at line {line}. It pins the code to one environment. Read it from configuration. Loopback and 0.0.0.0 are not reported: they name this machine rather than a particular host.

Flagged

const host = '192.168.1.50';

const dns = "8.8.8.9";

const near = "1.1.1.4";

const dns = "223.5.5.5";

const url = 'http://198.20.0.1/x';

const near = "192.0.1.1";

const relay = "192.88.100.1";

const below = "100.63.255.255";

const above = "100.128.0.1";

const bench = "198.20.0.1";

Not flagged

const host = process.env.DB_HOST;

const version = '1.2';

const local = '127.0.0.1';

const bind = '0.0.0.0';

const doc = '203.0.113.0';

const example = "192.0.2.10";

const other = '198.51.100.7';

const netmask = "255.240.0.0";

const mask = '255.255.255.0';

"192.0.0.0/24",

"192.88.99.0/24",

const thisNet = "0.1.2.3";

const cgnat = "100.64.0.1";

const cgnatTop = "100.127.255.254";

const benchmark = "198.18.0.1";

const benchmarkTop = "198.19.255.1";

"224.0.0.0/4",     # Multicast addresses

"240.0.0.0/4",     # Reserved for future use

const group = '239.255.255.250';

const agent = 'Mozilla/5.0 (X11) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36';

const dns = "8.8.8.8";

const cloudflare = '1.1.1.3';

upstream = ["9.9.9.9", "94.140.14.14"]

Pattern

(?<![A-Za-z]/)\b(?!127\.|0\.|(?:22[4-9]|2[34][0-9]|25[0-5])\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.|192\.0\.0\.|192\.88\.99\.|100\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.|198\.1[89]\.|(?:8\.8\.8\.8|8\.8\.4\.4|1\.1\.1\.1|1\.0\.0\.1|1\.1\.1\.2|1\.0\.0\.2|1\.1\.1\.3|1\.0\.0\.3|9\.9\.9\.9|149\.112\.112\.112|9\.9\.9\.10|149\.112\.112\.10|9\.9\.9\.11|149\.112\.112\.11|208\.67\.222\.222|208\.67\.220\.220|208\.67\.222\.220|208\.67\.220\.222|208\.67\.222\.123|208\.67\.220\.123|94\.140\.14\.14|94\.140\.15\.15|94\.140\.14\.15|94\.140\.15\.16|94\.140\.14\.140|94\.140\.14\.141)\b)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b