thanks. What is the issue with the indentation change? Also can you please fix the codeql warning? I think the hostname cannot be null anyhow, since you add a test for it right at the beginning.

hi @chrisbra !

ad indentation - I followed the style in the function - there is 4 space per indent, and every 8 spaces is a tab - I have followed this style in the file and it is why Github shows it that way (so far I have not been able to set Github to show tabs properly - that's why personally prefer using spaces everywhere - everywhere it is shown the same way).

ad codecov error - I have fixed it now.

Thank you for the review!

OT question - is it expected to pass non-localhost address to that function in plugins, or only loopback? I could send PR for enforcing loopback, which could narrow the attack vector further.

That is tricky. I think we should try to restrict to localhost if possible. @mattn does that work for you?

@chrisbra can we merge this PR for now? I can pass another PR separately.

I'd prefer changing the default from INADDR_ANY to INADDR_LOOPBACK instead of requiring the hostname. This achieves the same security improvement without breaking backward compatibility. The change would be just one line:

-	server.sin_addr.s_addr = htonl(INADDR_ANY);
+	server.sin_addr.s_addr = htonl(INADDR_LOOPBACK);

Also, the default binding behavior when the hostname is omitted is not documented. It would be good to document that it defaults to localhost (loopback), and that "0.0.0.0" can be specified to listen on all interfaces.

@mattn @chrisbra preferably I would like to make Vim able to connect to loopback only in all cases and only leave to user to define which hostname/IP address version they can use for loopback. Providing a way how to listen on network addresses might open the process to the internet, which I'm not sure whether Vim is ready to serve as such security and performance-wise.

I agree, I don't want to expose Vim over the network. localhost only

@chrisbra I have updated the MR and desc accordingly, and rebased the MR. Feel free to review and merge.

If we only want to allow loopback connections, the function should not accept a hostname at all. Accepting a hostname string and then rejecting non-loopback addresses after resolution is the wrong approach — it implies the caller can choose the bind address when they can't.

The proper fix would be to only accept a port number and always bind to INADDR_LOOPBACK internally. This eliminates the need for hostname resolution code in channel_listen() entirely.

Also, the indentation in the patch is incorrect. Vim source uses a mix of tabs and spaces for indentation — please match the existing style in the file.