fix(validator): also reject path-style DoH in dns_fallback_server
A value like 'cloudflare-dns.com/dns-query' is the sing-box DoH
path format. The previous check only caught 'https://' URLs.
dns_server_value_valid() accepts it because it validates only the
host part — so 'cloudflare-dns.com' passed as a valid hostname.
Fallback servers are plain UDP only; any '/' in the value is the
DoH path separator and must be rejected.
Changes:
- validator.uc: add index(value, '/') >= 0 check before the
dns_server_value_valid call
- config_validator_runtime.sh: add regression test for path-style
DoH ('cloudflare-dns.com/dns-query') in dns_fallback_server
This commit is contained in:
@@ -273,6 +273,20 @@ cat >"$WORK_DIR/url-in-fallback-dns.json" <<'JSON'
|
||||
JSON
|
||||
assert_rejects "URL in dns_fallback_server" "$WORK_DIR/url-in-fallback-dns.json" "Fallback DNS server"
|
||||
|
||||
cat >"$WORK_DIR/path-doh-in-fallback-dns.json" <<'JSON'
|
||||
{
|
||||
"settings": {
|
||||
".name": "settings",
|
||||
".type": "settings",
|
||||
"dns_server": [ "1.1.1.1" ],
|
||||
"bootstrap_dns_server": [ "77.88.8.8" ],
|
||||
"dns_fallback_server": [ "cloudflare-dns.com/dns-query" ]
|
||||
},
|
||||
"section": []
|
||||
}
|
||||
JSON
|
||||
assert_rejects "path-style DoH in dns_fallback_server" "$WORK_DIR/path-doh-in-fallback-dns.json" "Fallback DNS server"
|
||||
|
||||
cat >"$WORK_DIR/bad-dns-rule-matchers.json" <<'JSON'
|
||||
{
|
||||
"settings": { ".name": "settings", ".type": "settings" },
|
||||
|
||||
Reference in New Issue
Block a user