net: reject non-address SocketAddress.parse input

doc/api/net.md

@@ -295,6 +295,13 @@ added:
 * Returns: {net.SocketAddress} Returns a `SocketAddress` if parsing was successful.
   Otherwise returns `undefined`.
 
+The address portion of `input` must be a valid IPv4 or IPv6 address as
+recognized by the [WHATWG URL host parser][], and `input` may contain only
+hexadecimal digits, `x`, `.`, `:`, `[`, and `]`. Anything else returns
+`undefined`, including host names such as `example.com`, other URL components
+such as `user@1.2.3.4` or `1.2.3.4/foo`, whitespace, control characters,
+percent-encoding, and non-ASCII characters.
+
 ## Class: `net.Server`
 
 <!-- YAML
@@ -2287,6 +2294,7 @@ net.isIPv6('fhqwhgads'); // returns false
 [RFC 8305]: https://www.rfc-editor.org/rfc/rfc8305.txt
 [Readable Stream]: stream.md#class-streamreadable
 [Transferring TCP handles to other threads]: #transferring-tcp-handles-to-other-threads
+[WHATWG URL host parser]: https://url.spec.whatwg.org/#host-parsing
 [`'close'`]: #event-close
 [`'connect'`]: #event-connect
 [`'connection'`]: #event-connection

lib/internal/socketaddress.js

@@ -2,6 +2,7 @@
 
 const {
   ObjectSetPrototypeOf,
+  RegExpPrototypeExec,
   Symbol,
 } = primordials;
 
@@ -42,6 +43,9 @@ const { URLParse } = require('internal/url');
 const kHandle = Symbol('kHandle');
 const kDetail = Symbol('kDetail');
 
+// The complete character set of an "${address}:${port}" input.
+const kValidInput = /^[0-9a-fA-FxX.:[\]]+$/;
+
 class SocketAddress {
   static isSocketAddress(value) {
     return value?.[kHandle] !== undefined;
@@ -149,6 +153,7 @@ class SocketAddress {
    */
   static parse(input) {
     validateString(input, 'input');
+    if (RegExpPrototypeExec(kValidInput, input) === null) return;
     // While URL.parse is not expected to throw, there are several
     // other pieces here that do... the destucturing, the SocketAddress
     // constructor, etc. So we wrap this in a try/catch to be safe.

test/parallel/test-socketaddress.js

@@ -162,6 +162,47 @@ describe('net.SocketAddress...', () => {
       'abc.123',
       '259.1.1.1',
       '12:12:12',
+      // Host names.
+      'cabbage.ca',
+      'cafe',
+      'bad.cafe',
+      'dead.beef',
+      // Arbitrary URL components.
+      'user:80@5.6.7.8',
+      'user@1.2.3.4',
+      '1.2.3.4/',
+      '1.2.3.4/foo',
+      '1.2.3.4\\foo',
+      '1.2.3.4?a=b',
+      '1.2.3.4#frag',
+      '[1::8]:123/x',
+      'http://1.2.3.4',
+      // Whitespace and control characters.
+      '1.2.3\n.4',
+      '1.2.3\t.4',
+      '1.2.3.4\r',
+      '1.2.3.4 ',
+      ' 1.2.3.4',
+      '1.2.3.4\x00',
+      '1.2.3.4\x0b',
+      '1.2.3.4\x7f',
+      // Percent-encoding.
+      '1.2.3.%34',
+      '1%2E2%2E3%2E4',
+      '%30%78%66%66%66%66%66%66%66%66',
+      '1.2.3.%34:8080',
+      // IDNA.
+      '１２７.０.０.１',
+      '０ｘ７ｆ.1',
+      '1。2。3。4',
+      '1｡2｡3｡4',
+      '⑧.0.0.1',
+      '1.2.3.4\u200b',
+      '1.2.3.4\ufeff',
+      '1.2.3.4\u00ad',
+      '1.2.3.4\u180e',
+      '1.2.3.4\u2064',
+      '1.2.3.4\ufe00',
     ];
 
     bad.forEach((i) => {