From b0d76651b45e1dc6c5fe8920ee26468ed9fdc723 Mon Sep 17 00:00:00 2001 From: devteamaegis Date: Sun, 2 Aug 2026 16:38:59 -0400 Subject: [PATCH] fix(events): Match.cidr rejects IPv6 addresses with an embedded IPv4 address The IPv6 branch of the cidr() validation regex lost its backslashes, so every embedded-IPv4 octet group reads as a literal letter instead of a digit: (25[0-5]|2[0-4]d|1dd|[1-9]?d) matches 'd', not \d, and the separator '.' matches any character. Match.cidr('::ffff:192.168.0.1') therefore threw 'Invalid IP address range' at synth time, while the nonsense range '::ffff:1dd.1dd.1dd.1dd' was accepted. Restore \d, \. and \s in that group. --- .../aws-events/lib/event-pattern.ts | 2 +- .../aws-events/test/matchers.test.ts | 21 +++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/packages/aws-cdk-lib/aws-events/lib/event-pattern.ts b/packages/aws-cdk-lib/aws-events/lib/event-pattern.ts index 41332c785e136..7aa5e1c269877 100644 --- a/packages/aws-cdk-lib/aws-events/lib/event-pattern.ts +++ b/packages/aws-cdk-lib/aws-events/lib/event-pattern.ts @@ -93,7 +93,7 @@ export class Match implements IResolvable { */ public static cidr(range: string): string[] { const ipv4Regex = /^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([0-9]|[1-2][0-9]|3[0-2]))?$/igm; - const ipv6Regex = /^s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]d|1dd|[1-9]?d)(.(25[0-5]|2[0-4]d|1dd|[1-9]?d)){3}))|:)))(%.+)?s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$/igm; + const ipv6Regex = /^\s*((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?\s*(\/([0-9]|[1-9][0-9]|1[0-1][0-9]|12[0-8]))?$/igm; if (!ipv4Regex.test(range) && !ipv6Regex.test(range)) { throw new UnscopedValidationError(lit`InvalidIpAddressRange`, `Invalid IP address range: ${range}`); diff --git a/packages/aws-cdk-lib/aws-events/test/matchers.test.ts b/packages/aws-cdk-lib/aws-events/test/matchers.test.ts index 573ee78dd34eb..abd62a7ae4a62 100644 --- a/packages/aws-cdk-lib/aws-events/test/matchers.test.ts +++ b/packages/aws-cdk-lib/aws-events/test/matchers.test.ts @@ -104,6 +104,27 @@ describe(Match, () => { expect(() => stack.resolve(Match.cidr('a.b.c/31'))).toThrow(/Invalid IP address range/); }); + test('cidr accepts IPv6 addresses with an embedded IPv4 address', () => { + for (const range of [ + '::ffff:192.168.0.1', + '::ffff:192.168.0.1/128', + '2001:db8::192.168.0.1', + '64:ff9b::192.0.2.33/96', + ]) { + expect(stack.resolve(Match.cidr(range))).toEqual([{ cidr: range }]); + } + }); + + test('cidr rejects IPv6 addresses with a malformed embedded IPv4 address', () => { + for (const range of [ + '::ffff:1dd.1dd.1dd.1dd', + '::ffff:256.0.0.1', + '::ffff:999.999.999.999', + ]) { + expect(() => stack.resolve(Match.cidr(range))).toThrow(/Invalid IP address range/); + } + }); + test('anyOf', () => { expect(stack.resolve(Match.anyOf(Match.equal(0), Match.equal(1)))).toEqual([ { numeric: ['=', 0] },