`Iri#port` accepts 65536 due to off-by-one in `lib/iri.rb:262`
#260 opened on Jun 23, 2026
Repository metrics
- Stars
- (145 stars)
- PR merge metrics
- (PR metrics pending)
Description
In lib/iri.rb:262, the upper-bound port guard is off by one: it raises only when val > 65_536, which lets 65536 itself through. The valid TCP port range is 1..65535, so the boundary value should be rejected.
The error message on the same line reinforces the off-by-one ("The port can't be larger than 65536"). Both the comparison and the message refer to 65536 instead of 65535.
Reproduction with the current master:
require 'iri'
Iri.new('http://x').port(65536).to_s # => "http://x:65536"
The expected behavior is ArgumentError, matching what the helper already does for negative? and zero? on lines 260–261. test/test_iri.rb has no boundary tests for port — the only port tests at lines 90–99 use 443 and 8080, and the nil case is covered at line 199, but 65535 and 65536 are not exercised, which is why the off-by-one has not surfaced.
Suggested fix: change val > 65_536 to val > 65_535 and update the message string to "65535", then add two cases to test/test_iri.rb: a positive case for 65535 and a negative case for 65536 raising ArgumentError.