mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-04-22 20:45:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb: Add port blacklist for ResourceLoader::load

Browse source 
`ResourceLoader::load` now rejects URLs which specify a `port`
associated with network services known to be vulnerable to
inter-protocol exploitation.

Fixes #1735
This commit is contained in:
Brendan Coles 2020-04-12 04:01:34 +00:00 • committed by Andreas Kling
parent c8d0a2eb3c
commit 2d699cd5da
Notes: sideshowbarker 2024-07-19 07:41:32 +09:00
2 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
Libraries/LibWeb/ResourceLoader.cpp
View file

@ -67,6 +67,11 @@ void ResourceLoader::load_sync(const URL& url, Function<void(const ByteBuffer&)>
void ResourceLoader::load(const URL& url, Function<void(const ByteBuffer&)> success_callback, Function<void(const String&)> error_callback)
{
if (is_port_blocked(url.port())) {
dbg() << "ResourceLoader::load: Error: blocked port " << url.port() << " for URL: " << url;
return;
}
if (url.protocol() == "file") {
auto f = Core::File::construct();
f->set_filename(url.path());
@ -112,4 +117,16 @@ void ResourceLoader::load(const URL& url, Function<void(const ByteBuffer&)> succ
error_callback(String::format("Protocol not implemented: %s", url.protocol().characters()));
}
bool ResourceLoader::is_port_blocked(int port) {
int ports[] { 1, 7, 9, 11, 13, 15, 17, 19, 20, 21, 22, 23, 25, 37, 42,
43, 53, 77, 79, 87, 95, 101, 102, 103, 104, 109, 110, 111, 113,
115, 117, 119, 123, 135, 139, 143, 179, 389, 465, 512, 513, 514,
515, 526, 530, 531, 532, 540, 556, 563, 587, 601, 636, 993, 995,
2049, 3659, 4045, 6000, 6379, 6665, 6666, 6667, 6668, 6669, 9000 };
for (auto blocked_port : ports)
if (port == blocked_port)
return true;
return false;
}
}

1
Libraries/LibWeb/ResourceLoader.h
View file

@ -55,6 +55,7 @@ private:
Protocol::Client& protocol_client() { return *m_protocol_client; }
RefPtr<Protocol::Client> m_protocol_client;
bool is_port_blocked(int port);
};
}