Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-23 21:01:08 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1889130 - block http requests on 0.0.0.0 address. r=necko-reviewers,valentin,kershaw

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D219041
This commit is contained in:
smayya 2024-08-19 13:31:42 +00:00
parent c2b1e09471
commit e32b3654e0
4 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
modules/libpref/init/StaticPrefList.yaml
View File

@ -12444,6 +12444,13 @@
value: true value: true
mirror: always mirror: always
# Disable requests to 0.0.0.0
# See Bug 1889130
- name: network.socket.ip_addr_any.disabled
type: RelaxedAtomicBool
value: @IS_EARLY_BETA_OR_EARLIER@
mirror: always
# Set true to allow resolving proxy for localhost # Set true to allow resolving proxy for localhost
- name: network.proxy.allow_hijacking_localhost - name: network.proxy.allow_hijacking_localhost
type: RelaxedAtomicBool type: RelaxedAtomicBool

1
netwerk/base/nsIOService.cpp
View File

@ -241,6 +241,7 @@ static const char* gCallbackPrefsForSocketProcess[] = {
"network.proxy.allow_hijacking_localhost", "network.proxy.allow_hijacking_localhost",
"network.connectivity-service.", "network.connectivity-service.",
"network.captive-portal-service.testMode", "network.captive-portal-service.testMode",
"network.socket.ip_addr_any.disabled",
nullptr, nullptr,
}; };

9
netwerk/base/nsSocketTransport2.cpp
View File

@ -1241,6 +1241,15 @@ nsresult nsSocketTransport::InitiateSocket() {
if (gIOService->IsNetTearingDown()) { if (gIOService->IsNetTearingDown()) {
return NS_ERROR_ABORT; return NS_ERROR_ABORT;
} }
// Since https://github.com/whatwg/fetch/pull/1763,
// we need to disable access to 0.0.0.0 for non-test purposes
if (StaticPrefs::network_socket_ip_addr_any_disabled() &&
mNetAddr.IsIPAddrAny() && !mProxyTransparentResolvesHost) {
SOCKET_LOG(("connection refused NS_ERROR_CONNECTION_REFUSED\n"));
return NS_ERROR_CONNECTION_REFUSED;
}
if (gIOService->IsOffline()) { if (gIOService->IsOffline()) {
if (StaticPrefs::network_disable_localhost_when_offline() || !isLocal) { if (StaticPrefs::network_disable_localhost_when_offline() || !isLocal) {
return NS_ERROR_OFFLINE; return NS_ERROR_OFFLINE;

3
netwerk/test/unit/trr_common.js
View File

@ -1027,6 +1027,7 @@ async function test_ipv4_trr_fallback() {
async function test_no_retry_without_doh() { async function test_no_retry_without_doh() {
info("Bug 1648147 - if the TRR returns 0.0.0.0 we should not retry with DNS"); info("Bug 1648147 - if the TRR returns 0.0.0.0 we should not retry with DNS");
Services.prefs.setBoolPref("network.trr.fallback-on-zero-response", false); Services.prefs.setBoolPref("network.trr.fallback-on-zero-response", false);
Services.prefs.setBoolPref("network.socket.ip_addr_any.disabled", false);
async function test(url, ip) { async function test(url, ip) {
setModeAndURI(2, `doh?responseIP=${ip}`); setModeAndURI(2, `doh?responseIP=${ip}`);
@ -1073,6 +1074,8 @@ async function test_no_retry_without_doh() {
await test(`http://unknown.ipv4.stuff:666/path`, "0.0.0.0"); await test(`http://unknown.ipv4.stuff:666/path`, "0.0.0.0");
await test(`http://unknown.ipv6.stuff:666/path`, "::"); await test(`http://unknown.ipv6.stuff:666/path`, "::");
} }
Services.prefs.clearUserPref("network.socket.ip_addr_any.disabled");
} }
async function test_connection_reuse_and_cycling() { async function test_connection_reuse_and_cycling() {