VBC-901: hardcoded-ip-v4

warning

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .go, .java, .json, .env, .astro
Scope: string and template literals only
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/testdata/**, **/fixtures/**, **/test_*.py, **/*_test.py, **/test.py, **/conftest.py, **/*_test.go, **/*_bench.go, **/*.test.*, **/*.spec.*, **/bench/**, **/benchmark*, **/*corpus*, **/*payload*
Tags: security

What it reports

Hardcoded IP address at line {line}. It pins the code to one environment. Read it from configuration. Loopback and 0.0.0.0 are not reported: they name this machine rather than a particular host.

Flagged

const host = '192.168.1.50';

const dns = "8.8.8.8";

Not flagged

const host = process.env.DB_HOST;

const version = '1.2';

const local = '127.0.0.1';

const bind = '0.0.0.0';

const doc = '203.0.113.0';

const example = "192.0.2.10";

const other = '198.51.100.7';

const netmask = "255.240.0.0";

const mask = '255.255.255.0';

Pattern

\b(?!127\.|0\.0\.0\.0\b|255\.|192\.0\.2\.|198\.51\.100\.|203\.0\.113\.)(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b