vw_small

commit 0d2399d485e7933ba08dc354200e545fa03f3d90
parent 7a7673103fb180098f18abe77b75ba085710b559
Author: BlackDex <black.dex@gmail.com>
Date:   Mon, 14 Nov 2022 17:25:44 +0100

Prevent DNS leak when icon regex is configured

When a icon blacklist regex was configured to not check for a domain, it
still did a DNS lookup first. This could cause a DNS leakage for these
regex blocked domains.

This PR resolves this issue by first checking the regex, and afterwards
the other checks.

Fixes #2909

Diffstat:
M
src/api/icons.rs
 | 
25
++++++++++++++-----------
M
src/static/images/fallback-icon.png
 | 
0

2 files changed, 14 insertions(+), 11 deletions(-)
diff --git a/src/api/icons.rs b/src/api/icons.rs
@@ -262,17 +262,8 @@ use cached::proc_macro::cached;
 #[cached(key = "String", convert = r#"{ domain.to_string() }"#, size = 16, time = 60)]
 #[allow(clippy::unused_async)] // This is needed because cached causes a false-positive here.
 async fn is_domain_blacklisted(domain: &str) -> bool {
-    if CONFIG.icon_blacklist_non_global_ips() {
-        if let Ok(s) = lookup_host((domain, 0)).await {
-            for addr in s {
-                if !is_global(addr.ip()) {
-                    debug!("IP {} for domain '{}' is not a global IP!", addr.ip(), domain);
-                    return true;
-                }
-            }
-        }
-    }
-
+    // First check the blacklist regex if there is a match.
+    // This prevents the blocked domain(s) from being leaked via a DNS lookup.
     if let Some(blacklist) = CONFIG.icon_blacklist_regex() {
         // Use the pre-generate Regex stored in a Lazy HashMap if there's one, else generate it.
         let is_match = if let Some(regex) = ICON_BLACKLIST_REGEX.get(&blacklist) {
@@ -297,6 +288,18 @@ async fn is_domain_blacklisted(domain: &str) -> bool {
             return true;
         }
     }
+
+    if CONFIG.icon_blacklist_non_global_ips() {
+        if let Ok(s) = lookup_host((domain, 0)).await {
+            for addr in s {
+                if !is_global(addr.ip()) {
+                    debug!("IP {} for domain '{}' is not a global IP!", addr.ip(), domain);
+                    return true;
+                }
+            }
+        }
+    }
+
     false
 }
 
diff --git a/src/static/images/fallback-icon.png b/src/static/images/fallback-icon.png
Binary files differ.