Skip to content

Conversation

@bitterpanda63
Copy link
Member

@bitterpanda63 bitterpanda63 commented Dec 8, 2025

Summary by Aikido

⚠️ Security Issues: 1 🔍 Quality Issues: 3 Resolved Issues: 0

🚀 New Features

  • Added pure-Python ip_matcher_fallback module and runtime pytricia warning.

⚡ Enhancements

  • Replaced internal matcher with pytricia-backed IPMatcher and preparse.

🔧 Refactors

  • Refactored callers to initialize IPMatcher with lists and freeze.

More info

@bitterpanda63 bitterpanda63 changed the title IPMatcher: Switch node logic out in favour of pytricia Use pytricia for ip matching on non-windows machines Jan 14, 2026


def preparse(network: str) -> str:
# Remove the brackets around IPv6 addresses if they are there.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment on preparse merely restates the code. Either remove it or replace with why this normalization is needed (e.g., to canonicalize bracketed IPv6 and IPv4-mapped IPv6 inputs).

Details

✨ AI Reasoning
​A newly added comment adjacent to the preparse function only restates what the code does (removing square brackets). It doesn't explain why this normalization is required (e.g., to handle bracketed IPv6 input or IPv4-mapped IPv6 addresses in callers), so it provides low informational value and increases maintenance burden.

🔧 How do I fix it?
Write comments that explain the purpose, reasoning, or business logic behind the code using words like 'because', 'so that', or 'in order to'.

Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info


def test_with_ranges():
input_list = [
"192.168.0.0/24",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe good to test with multiple overlapping ranges too?

Copy link
Member Author

@bitterpanda63 bitterpanda63 Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these test cases are from node iirc? (also a bit out of scope, since this was existing code copied over)

matcher = IPMatcher(input_list)
assert matcher.has("::ffff:0.0.0.0") == True
assert matcher.has("::ffff:127.0.0.1") == True
assert matcher.has("::ffff:123") == False
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so this case is different for both?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, PyTricia is more accurate in this regard, this is also not a huge issue, and I think no one is running with windows in production. Given IPC also doesnt work

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants