net/url: validate ports in IPv4 addresses

Fixes #14860

Change-Id: Id55ad942d45a104d560a879d6e8e1aa09671789b
Reviewed-on: https://go-review.googlesource.com/22351Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

src/net/url/url.go

@@ -573,8 +573,12 @@ func parseHost(host string) (string, error) {
 			}
 			return host1 + host2 + host3, nil
 		}
+	} else if i := strings.LastIndex(host, ":"); i > 0 {
+		colonPort := host[i:]
+		if !validOptionalPort(colonPort) {
+			return "", fmt.Errorf("invalid port %q after host", colonPort)
+		}
 	}
-
 	var err error
 	if host, err = unescape(host, encodeHost); err != nil {
 		return "", err

src/net/url/url_test.go

@@ -418,10 +418,10 @@ var urltests = []URLTest{
 	},
 	// worst case host, still round trips
 	{
-		"scheme://!$&'()*+,;=hello!:port/path",
+		"scheme://!$&'()*+,;=hello!:8080/path",
 		&URL{
 			Scheme: "scheme",
-			Host:   "!$&'()*+,;=hello!:port",
+			Host:   "!$&'()*+,;=hello!:8080",
 			Path:   "/path",
 		},
 		"",
@@ -636,8 +636,10 @@ var parseRequestURLTests = []struct {
 	{"*", true},
 	{"http://192.168.0.1/", true},
 	{"http://192.168.0.1:8080/", true},
+	{"http://192.168.0.1:foo/", false},
 	{"http://[fe80::1]/", true},
 	{"http://[fe80::1]:8080/", true},
+	{"http://[fe80::1]:foo/", false},
 
 	// Tests exercising RFC 6874 compliance:
 	{"http://[fe80::1%25en0]/", true},                 // with alphanum zone identifier