1
0
Fork 0

Merge pull request #2921 from BlackDex/issue-2909

Prevent DNS leak when icon regex is configured
Dieser Commit ist enthalten in:
Daniel García 2022-11-27 22:00:54 +01:00 committet von GitHub
Commit 366b1050ec
Es konnte kein GPG-Schlüssel zu dieser Signatur gefunden werden
GPG-Schlüssel-ID: 4AEE18F83AFDEB23
2 geänderte Dateien mit 14 neuen und 11 gelöschten Zeilen

Datei anzeigen

@ -262,17 +262,8 @@ use cached::proc_macro::cached;
#[cached(key = "String", convert = r#"{ domain.to_string() }"#, size = 16, time = 60)]
#[allow(clippy::unused_async)] // This is needed because cached causes a false-positive here.
async fn is_domain_blacklisted(domain: &str) -> bool {
if CONFIG.icon_blacklist_non_global_ips() {
if let Ok(s) = lookup_host((domain, 0)).await {
for addr in s {
if !is_global(addr.ip()) {
debug!("IP {} for domain '{}' is not a global IP!", addr.ip(), domain);
return true;
}
}
}
}
// First check the blacklist regex if there is a match.
// This prevents the blocked domain(s) from being leaked via a DNS lookup.
if let Some(blacklist) = CONFIG.icon_blacklist_regex() {
// Use the pre-generate Regex stored in a Lazy HashMap if there's one, else generate it.
let is_match = if let Some(regex) = ICON_BLACKLIST_REGEX.get(&blacklist) {
@ -297,6 +288,18 @@ async fn is_domain_blacklisted(domain: &str) -> bool {
return true;
}
}
if CONFIG.icon_blacklist_non_global_ips() {
if let Ok(s) = lookup_host((domain, 0)).await {
for addr in s {
if !is_global(addr.ip()) {
debug!("IP {} for domain '{}' is not a global IP!", addr.ip(), domain);
return true;
}
}
}
}
false
}

Binäre Datei nicht angezeigt.

Vorher

Breite:  |  Höhe:  |  Größe: 331 B

Nachher

Breite:  |  Höhe:  |  Größe: 483 B