From 94b4e497a88268288b9eb31f49aac63b460fe725 Mon Sep 17 00:00:00 2001 From: William Harrison <87287585+wdhdev@users.noreply.github.com> Date: Mon, 13 Jan 2025 14:29:51 +0800 Subject: [PATCH 1/3] more validations --- dnsconfig.js | 52 +++++++------------------------------------ tests/records.test.js | 40 ++++++++++++++++++++++++++++++++- 2 files changed, 47 insertions(+), 45 deletions(-) diff --git a/dnsconfig.js b/dnsconfig.js index 91d9437f7..3cd55b011 100644 --- a/dnsconfig.js +++ b/dnsconfig.js @@ -29,18 +29,14 @@ for (var subdomain in domains) { // Handle A records if (domainData.record.A) { for (var a in domainData.record.A) { - records.push( - A(subdomainName, IP(domainData.record.A[a]), proxyState) - ); + records.push(A(subdomainName, IP(domainData.record.A[a]), proxyState)); } } // Handle AAAA records if (domainData.record.AAAA) { for (var aaaa in domainData.record.AAAA) { - records.push( - AAAA(subdomainName, domainData.record.AAAA[aaaa], proxyState) - ); + records.push(AAAA(subdomainName, domainData.record.AAAA[aaaa], proxyState)); } } @@ -48,28 +44,14 @@ for (var subdomain in domains) { if (domainData.record.CAA) { for (var caa in domainData.record.CAA) { var caaRecord = domainData.record.CAA[caa]; - records.push( - CAA( - subdomainName, - caaRecord.tag, - caaRecord.value - ) - ); + records.push(CAA(subdomainName, caaRecord.tag, caaRecord.value)); } } // Handle CNAME records if (domainData.record.CNAME) { - // Allow CNAME record on root - if (subdomainName === "@") { - records.push( - ALIAS(subdomainName, domainData.record.CNAME + ".", proxyState) - ); - } else { - records.push( - CNAME(subdomainName, domainData.record.CNAME + ".", proxyState) - ); - } + // Use ALIAS instead of CNAME to support CNAME flattening on the root domain + records.push(ALIAS(subdomainName, domainData.record.CNAME + ".", proxyState)); } // Handle DS records @@ -77,13 +59,7 @@ for (var subdomain in domains) { for (var ds in domainData.record.DS) { var dsRecord = domainData.record.DS[ds]; records.push( - DS( - subdomainName, - dsRecord.key_tag, - dsRecord.algorithm, - dsRecord.digest_type, - dsRecord.digest - ) + DS(subdomainName, dsRecord.key_tag, dsRecord.algorithm, dsRecord.digest_type, dsRecord.digest) ); } } @@ -91,13 +67,7 @@ for (var subdomain in domains) { // Handle MX records if (domainData.record.MX) { for (var mx in domainData.record.MX) { - records.push( - MX( - subdomainName, - 10 + parseInt(mx), - domainData.record.MX[mx] + "." - ) - ); + records.push(MX(subdomainName, 10 + parseInt(mx), domainData.record.MX[mx] + ".")); } } @@ -113,13 +83,7 @@ for (var subdomain in domains) { for (var srv in domainData.record.SRV) { var srvRecord = domainData.record.SRV[srv]; records.push( - SRV( - subdomainName, - srvRecord.priority, - srvRecord.weight, - srvRecord.port, - srvRecord.target + "." - ) + SRV(subdomainName, srvRecord.priority, srvRecord.weight, srvRecord.port, srvRecord.target + ".") ); } } diff --git a/tests/records.test.js b/tests/records.test.js index 4d03a0e75..a13530cf5 100644 --- a/tests/records.test.js +++ b/tests/records.test.js @@ -95,11 +95,13 @@ function validateRecordValues(t, data, file) { // General validation for arrays if (["A", "AAAA", "MX", "NS"].includes(key)) { t.true(Array.isArray(value), `${file}: Record value for ${key} should be an array`); + value.forEach((record, idx) => { t.true( typeof record === "string", `${file}: Record value for ${key} should be a string at index ${idx}` ); + if (key === "A") { t.true(ipv4Regex.test(record), `${file}: Invalid IPv4 address for ${key} at index ${idx}`); t.true( @@ -119,6 +121,7 @@ function validateRecordValues(t, data, file) { // CNAME and URL validations if (["CNAME", "URL"].includes(key)) { t.true(typeof value === "string", `${file}: Record value for ${key} should be a string`); + if (key === "CNAME") { t.true(isValidHostname(value), `${file}: Invalid hostname for ${key}`); t.true(value !== file, `${file}: CNAME cannot point to itself`); @@ -132,6 +135,7 @@ function validateRecordValues(t, data, file) { const urlHost = new URL(value).host; const isSelfReferencing = file === "@.json" ? urlHost === "is-a.dev" : urlHost === `${subdomain}.is-a.dev`; + t.true(!isSelfReferencing, `${file}: URL cannot point to itself`); } } @@ -139,17 +143,51 @@ function validateRecordValues(t, data, file) { // CAA, DS, SRV validations if (["CAA", "DS", "SRV"].includes(key)) { t.true(Array.isArray(value), `${file}: Record value for ${key} should be an array`); + value.forEach((record, idx) => { t.true( typeof record === "object", `${file}: Record value for ${key} should be an object at index ${idx}` ); - if (key === "DS") { + + if (key === "CAA") { + t.true( + ["issue", "issuewild", "iodef"].includes(record.tag), + `${file}: Invalid tag for CAA at index ${idx}` + ); + t.true(typeof record.value === "string", `${file}: Invalid value for CAA at index ${idx}`); + t.true( + isValidHostname(record.value) || record.value === ";", + `${file}: Value must be a hostname or semicolon for CAA at index ${idx}` + ); + } else if (key === "DS") { t.true( Number.isInteger(record.key_tag) && record.key_tag >= 0 && record.key_tag <= 65535, `${file}: Invalid key_tag for DS at index ${idx}` ); + t.true( + Number.isInteger(record.algorithm) && record.algorithm >= 0 && record.algorithm <= 255, + `${file}: Invalid algorithm for DS at index ${idx}` + ); + t.true( + Number.isInteger(record.digest_type) && record.digest_type >= 0 && record.digest_type <= 255, + `${file}: Invalid digest_type for DS at index ${idx}` + ); t.true(isValidHexadecimal(record.digest), `${file}: Invalid digest for DS at index ${idx}`); + } else if (key === "SRV") { + t.true( + Number.isInteger(record.priority) && record.priority >= 0 && record.priority <= 65535, + `${file}: Invalid priority for SRV at index ${idx}` + ); + t.true( + Number.isInteger(record.weight) && record.weight >= 0 && record.weight <= 65535, + `${file}: Invalid weight for SRV at index ${idx}` + ); + t.true( + Number.isInteger(record.port) && record.port >= 0 && record.port <= 65535, + `${file}: Invalid port for SRV at index ${idx}` + ); + t.true(isValidHostname(record.target), `${file}: Invalid target for SRV at index ${idx}`); } }); } From 2249355301b12434a3de17e57aced36bdc356cb4 Mon Sep 17 00:00:00 2001 From: William Harrison <87287585+wdhdev@users.noreply.github.com> Date: Mon, 13 Jan 2025 14:31:28 +0800 Subject: [PATCH 2/3] reserve _zone-updated --- util/reserved-domains.json | 1 + 1 file changed, 1 insertion(+) diff --git a/util/reserved-domains.json b/util/reserved-domains.json index 797806d1b..0d2de4bd3 100644 --- a/util/reserved-domains.json +++ b/util/reserved-domains.json @@ -1,6 +1,7 @@ [ "_atproto", "_vercel", + "_zone-updated", "account", "accounts", "admin", From 5ca8e5bdbb86de30a289f8c2de2c1514b8c888a5 Mon Sep 17 00:00:00 2001 From: William Harrison <87287585+wdhdev@users.noreply.github.com> Date: Mon, 13 Jan 2025 14:31:53 +0800 Subject: [PATCH 3/3] no need to reserve domains starting with _ --- util/reserved-domains.json | 3 --- 1 file changed, 3 deletions(-) diff --git a/util/reserved-domains.json b/util/reserved-domains.json index 0d2de4bd3..16b3293c7 100644 --- a/util/reserved-domains.json +++ b/util/reserved-domains.json @@ -1,7 +1,4 @@ [ - "_atproto", - "_vercel", - "_zone-updated", "account", "accounts", "admin",