net: validate host name for server listen

Fixes: #54441
Co-authored-by: Luigi Pinca <luigipinca@gmail.com>
PR-URL: #54470
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jake Yuesong Li <jake.yuesong@gmail.com>

Author: jazelly

lib/net.js

@@ -35,6 +35,8 @@ const {
  NumberParseInt,
  ObjectDefineProperty,
  ObjectSetPrototypeOf,
+ RegExp,
+ RegExpPrototypeExec,
  Symbol,
  SymbolAsyncDispose,
  SymbolDispose,
@@ -143,6 +145,8 @@ const { kTimeout } = require('internal/timers');
 constDEFAULT_IPV4_ADDR='0.0.0.0';
 constDEFAULT_IPV6_ADDR='::';
 
+constHOST_REGEXP=newRegExp('^[a-zA-Z0-9-:%.]+$');
+
 constnoop=()=>{};
 
 constkPerfHooksNetConnectContext=Symbol('kPerfHooksNetConnectContext');
@@ -2020,6 +2024,10 @@ Server.prototype.listen = function(...args) {
 toNumber(args.length>2&&args[2]);// (port, host, backlog)
 
 options=options._handle||options.handle||options;
+if(typeofoptions.host==='string'&&RegExpPrototypeExec(HOST_REGEXP,options.host)===null){
+thrownewERR_INVALID_ARG_VALUE('host',options.host);
+}
+
 constflags=getFlags(options.ipv6Only);
 // Refresh the id to make the previous call invalid
 this._listeningId++;

test/parallel/test-net-server-listen-options.js

@@ -15,6 +15,10 @@ function close() { this.close(); }
 // Test listen({port})
 net.createServer().listen({port: 0})
 .on('listening',common.mustCall(close));
+// Test listen(host, port}) on ipv4
+net.createServer().listen({host: '127.0.0.1',port: '3000'}).on('listening',common.mustCall(close));
+// Test listen(host, port}) on ipv6
+net.createServer().listen({host: '::',port: '3001'}).on('listening',common.mustCall(close));
 }
 
 // Test listen(port, cb) and listen({ port }, cb) combinations
@@ -66,6 +70,13 @@ const listenOnPort = [
 name: 'TypeError',
 message: /^Theargument'options'musthavetheproperty"port"or"path"\.Received.+$/,
 });
+}elseif(typeofoptions.host==='string'&&!options.host.match(/^[a-zA-Z0-9-:%.]+$/)){
+assert.throws(fn,
+{
+code: 'ERR_INVALID_ARG_VALUE',
+name: 'TypeError',
+message: /^Theargument'host'isinvalid\.Received.+$/,
+});
 }else{
 assert.throws(fn,
 {
@@ -91,4 +102,5 @@ const listenOnPort = [
 shouldFailToListen({host: 'localhost:3000'});
 shouldFailToListen({host: {port: 3000}});
 shouldFailToListen({exclusive: true});
+shouldFailToListen({host: '[::]',port: 3000});
 }