wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-27 02:47:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Issue #2554 - Block access to 0.0.0.0 on non-Windows OSes.

Browse source 
Resolves #2554.
This commit is contained in:
Moonchild 2024-08-09 15:56:21 +02:00 • committed by roytam1
commit d44b309966
3 changed files with 22 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
modules/libpref/init/all.js
View file

@ -1885,6 +1885,16 @@ pref("network.dns.disablePrefetch", false);
// rejected before being given to DNS. RFC 7686 // rejected before being given to DNS. RFC 7686
pref("network.dns.blockDotOnion", true); pref("network.dns.blockDotOnion", true);
// This preference controls whether to block access to 0.0.0.0
// to mitigate local access issues in *NIX network stacks.
#if defined(XP_WIN)
// Windows is not affected, so don't block it there.
// XXX: any other OSes not having this issue?
pref("network.dns.blockQuad0", false);
#else
pref("network.dns.blockQuad0", true);
#endif
// These domains are treated as localhost equivalent // These domains are treated as localhost equivalent
pref("network.dns.localDomains", ""); pref("network.dns.localDomains", "");

11
netwerk/dns/nsDNSService2.cpp
View file

@ -48,6 +48,7 @@ static const char kPrefIPv4OnlyDomains[] = "network.dns.ipv4OnlyDomains";
static const char kPrefDisableIPv6[] = "network.dns.disableIPv6"; static const char kPrefDisableIPv6[] = "network.dns.disableIPv6";
static const char kPrefDisablePrefetch[] = "network.dns.disablePrefetch"; static const char kPrefDisablePrefetch[] = "network.dns.disablePrefetch";
static const char kPrefBlockDotOnion[] = "network.dns.blockDotOnion"; static const char kPrefBlockDotOnion[] = "network.dns.blockDotOnion";
static const char kPrefBlockQuad0[] = "network.dns.blockQuad0";
static const char kPrefDnsLocalDomains[] = "network.dns.localDomains"; static const char kPrefDnsLocalDomains[] = "network.dns.localDomains";
static const char kPrefDnsOfflineLocalhost[] = "network.dns.offline-localhost"; static const char kPrefDnsOfflineLocalhost[] = "network.dns.offline-localhost";
static const char kPrefDnsNotifyResolution[] = "network.dns.notifyResolution"; static const char kPrefDnsNotifyResolution[] = "network.dns.notifyResolution";
@ -537,6 +538,7 @@ nsDNSService::Init()
bool offlineLocalhost = true; bool offlineLocalhost = true;
bool disablePrefetch = false; bool disablePrefetch = false;
bool blockDotOnion = true; bool blockDotOnion = true;
bool blockQuad0 = false;
int proxyType = nsIProtocolProxyService::PROXYCONFIG_DIRECT; int proxyType = nsIProtocolProxyService::PROXYCONFIG_DIRECT;
bool notifyResolution = false; bool notifyResolution = false;
@ -561,6 +563,7 @@ nsDNSService::Init()
prefs->GetBoolPref(kPrefDnsOfflineLocalhost, &offlineLocalhost); prefs->GetBoolPref(kPrefDnsOfflineLocalhost, &offlineLocalhost);
prefs->GetBoolPref(kPrefDisablePrefetch, &disablePrefetch); prefs->GetBoolPref(kPrefDisablePrefetch, &disablePrefetch);
prefs->GetBoolPref(kPrefBlockDotOnion, &blockDotOnion); prefs->GetBoolPref(kPrefBlockDotOnion, &blockDotOnion);
prefs->GetBoolPref(kPrefBlockQuad0, &blockQuad0);
// If a manual proxy is in use, disable prefetch implicitly // If a manual proxy is in use, disable prefetch implicitly
prefs->GetIntPref("network.proxy.type", &proxyType); prefs->GetIntPref("network.proxy.type", &proxyType);
@ -579,6 +582,7 @@ nsDNSService::Init()
prefs->AddObserver(kPrefDnsOfflineLocalhost, this, false); prefs->AddObserver(kPrefDnsOfflineLocalhost, this, false);
prefs->AddObserver(kPrefDisablePrefetch, this, false); prefs->AddObserver(kPrefDisablePrefetch, this, false);
prefs->AddObserver(kPrefBlockDotOnion, this, false); prefs->AddObserver(kPrefBlockDotOnion, this, false);
prefs->AddObserver(kPrefBlockQuad0, this, false);
prefs->AddObserver(kPrefDnsNotifyResolution, this, false); prefs->AddObserver(kPrefDnsNotifyResolution, this, false);
// Monitor these to see if there is a change in proxy configuration // Monitor these to see if there is a change in proxy configuration
@ -612,6 +616,7 @@ nsDNSService::Init()
mOfflineLocalhost = offlineLocalhost; mOfflineLocalhost = offlineLocalhost;
mDisableIPv6 = disableIPv6; mDisableIPv6 = disableIPv6;
mBlockDotOnion = blockDotOnion; mBlockDotOnion = blockDotOnion;
mBlockQuad0 = blockQuad0;
// Disable prefetching either by explicit preference or if a manual proxy is configured // Disable prefetching either by explicit preference or if a manual proxy is configured
mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL); mDisablePrefetch = disablePrefetch || (proxyType == nsIProtocolProxyService::PROXYCONFIG_MANUAL);
@ -697,6 +702,12 @@ nsDNSService::PreprocessHostname(bool aLocalDomain,
return NS_ERROR_UNKNOWN_HOST; return NS_ERROR_UNKNOWN_HOST;
} }
// Enforce RFC 7686
if (mBlockQuad0 &&
aInput.EqualsASCII("0.0.0.0")) {
return NS_ERROR_UNKNOWN_HOST;
}
if (aLocalDomain) { if (aLocalDomain) {
aACE.AssignLiteral("localhost"); aACE.AssignLiteral("localhost");
return NS_OK; return NS_OK;

1
netwerk/dns/nsDNSService2.h
View file

@ -62,6 +62,7 @@ private:
bool mDisableIPv6; bool mDisableIPv6;
bool mDisablePrefetch; bool mDisablePrefetch;
bool mBlockDotOnion; bool mBlockDotOnion;
bool mBlockQuad0;
bool mFirstTime; bool mFirstTime;
bool mNotifyResolution; bool mNotifyResolution;
bool mOfflineLocalhost; bool mOfflineLocalhost;