[PR #12827/ccf218ab backport][3.15] Numeric ipv4 resolver bypass

[bdraco]

This is a backport of PR #12827 as merged into master (ccf218a).

What do these changes do?

is_ip_address() treats any digit-and-dot host as an IP literal, so TCPConnector._resolve_host() treated legacy numeric forms like 2130706433, 017700000001 and 127.1 as IP literals and handed the raw string straight to the socket layer instead of the configured resolver.

This adds is_canonical_ipv4_address(), which accepts only a standard dotted-quad with four decimal octets in range and no leading zeros, cross-checked against ipaddress.IPv4Address over a broad corpus. _resolve_host() now treats only canonical IPv4 literals (and IPv6) as IP addresses; any other numeric form is rejected with InvalidUrlClientError, and every non-literal host goes through the configured resolver as before.

Are there changes in behavior for the user?

A request to a non-canonical numeric IPv4 host now raises InvalidUrlClientError instead of being treated as an IP literal. Canonical dotted-quad addresses, IPv6 literals, and ordinary hostnames are unchanged.

Is it a substantial burden for the maintainers to support this?

No.

Related issue number

N/A

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes N/A
• If you provide code modification, please add yourself to CONTRIBUTORS.txt N/A, already listed
• Add a new news fragment into the CHANGES/ folder

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.21%. Comparing base (f09ae93) to head (9ef7219).
⚠️ Report is 321 commits behind head on 3.15.

Additional details and impacted files

@@           Coverage Diff           @@
##             3.15   #12850   +/-   ##
=======================================
  Coverage   98.21%   98.21%           
=======================================
  Files         135      135           
  Lines       47969    48018   +49     
  Branches     2567     2576    +9     
=======================================
+ Hits        47111    47161   +50     
  Misses        678      678           
+ Partials      180      179    -1     

Flag	Coverage Δ
CI-GHA	98.26% <100.00%> (+<0.01%)	⬆️
OS-Linux	98.03% <100.00%> (+<0.01%)	⬆️
OS-Windows	95.70% <100.00%> (+<0.01%)	⬆️
OS-macOS	97.21% <100.00%> (+<0.01%)	⬆️
Py-3.10	97.41% <100.00%> (+<0.01%)	⬆️
Py-3.11	97.69% <100.00%> (+<0.01%)	⬆️
Py-3.12	97.77% <100.00%> (+<0.01%)	⬆️
Py-3.13	97.74% <100.00%> (-0.01%)	⬇️
Py-3.14	97.86% <100.00%> (+<0.01%)	⬆️
Py-3.14t	96.84% <100.00%> (+<0.01%)	⬆️
Py-pypy-3.11	96.68% <100.00%> (-0.01%)	⬇️
VM-macos	97.21% <100.00%> (+<0.01%)	⬆️
VM-ubuntu	98.03% <100.00%> (+<0.01%)	⬆️
VM-windows	95.70% <100.00%> (+<0.01%)	⬆️
cython-coverage	38.21% <8.16%> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed]

Merging this PR will not alter performance

✅ 72 untouched benchmarks
⏩ 75 skipped benchmarks¹

---

_{Comparing patchback/backports/3.15/ccf218ab8c319faf166aff4d4c04f969fed7e341/pr-12827 (9ef7219) with 3.15 (f09ae93)}

Footnotes

1. 75 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩