From 5ee30535c41678209e52346fc69067753aa310b0 Mon Sep 17 00:00:00 2001
From: hackademix
Date: Sat, 5 Oct 2019 15:42:29 +0200
Subject: IPv4 subnet shortcut matching.

---
 src/common/Policy.js    | 27 ++++++++++++++++++++-------
 src/test/Policy_test.js |  8 +++++++-
 2 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/src/common/Policy.js b/src/common/Policy.js
index 674263a..71e6ff9 100644
--- a/src/common/Policy.js
+++ b/src/common/Policy.js
@@ -3,6 +3,7 @@ var {Permissions, Policy, Sites} = (() => {
   const SECURE_DOMAIN_PREFIX = "§:";
   const SECURE_DOMAIN_RX = new RegExp(`^${SECURE_DOMAIN_PREFIX}`);
   const DOMAIN_RX = new RegExp(`(?:^\\w+://|${SECURE_DOMAIN_PREFIX})?([^/]*)`, "i");
+  const IPV4_RX = /^(?:\d+\.){1,3}\d+/;
   const INTERNAL_SITE_RX = /^(?:(?:about|chrome|resource|(?:moz|chrome)-.*):|\[System)/;
   const VALID_SITE_RX = /^(?:(?:(?:(?:http|ftp|ws)s?|file):)(?:(?:\/\/)[\w\u0100-\uf000][\w\u0100-\uf000.-]*[\w\u0100-\uf000.](?:$|\/))?|[\w\u0100-\uf000][\w\u0100-\uf000.-]*[\w\u0100-\uf000]$)/;
 
@@ -158,6 +159,7 @@ var {Permissions, Policy, Sites} = (() => {
       if (!hostname) return null;
       if (!tld.preserveFQDNs) hostname = tld.normalize(hostname);
       let secure = protocol === "https:";
+      let isIPv4 = IPV4_RX.test(hostname);
       for (let domain = hostname;;) {
         if (this.has(domain)) {
           return domain;
@@ -168,13 +170,24 @@ var {Permissions, Policy, Sites} = (() => {
             return ssDomain;
           }
         }
-        let dotPos = domain.indexOf(".");
-        if (dotPos === -1) {
-          break;
-        }
-        domain = domain.substring(dotPos + 1); // sub
-        if (!domain) {
-          break;
+
+        if (isIPv4) {
+           // subnet shortcuts
+          let dotPos = domain.lastIndexOf(".");
+          if (!(dotPos > 3 || domain.indexOf(".") < dotPos)) {
+            break; // we want at least the 2 most significant bytes
+          }
+          domain = domain.substring(0, dotPos);
+        } else {
+          // (sub)domain matching
+          let dotPos = domain.indexOf(".");
+          if (dotPos === -1) {
+            break;
+          }
+          domain = domain.substring(dotPos + 1); // upper level
+          if (!domain) {
+            break;
+          }
         }
       }
       return null;
diff --git a/src/test/Policy_test.js b/src/test/Policy_test.js
index f658379..a0f92f3 100644
--- a/src/test/Policy_test.js
+++ b/src/test/Policy_test.js
@@ -7,6 +7,9 @@
   p1.set("https://flashgot.net", p1.TRUSTED);
   p1.set("http://flashgot.net", p1.UNTRUSTED);
   p1.set("perchè.com", p1.TRUSTED);
+  p1.set("10", p1.TRUSTED);
+  p1.set("192.168", p1.TRUSTED);
+  p1.set("192.168.69", p1.UNTRUSTED)
   let p2 = new Policy(p1.dry());
   debug("p1", JSON.stringify(p1.dry()));
   debug("p2", JSON.stringify(p2.dry()));
@@ -23,7 +26,10 @@
     () => !p1.can("http://secure.informaction.com"),
     () => p1.can("https://secure.informaction.com"),
     () => p1.can("https://www.secure.informaction.com"),
+    () => !p1.can("https://192.168.69.1"),
+    () => !p1.can("https://10.0.0.1"),
+    () => p1.can("http://192.168.1.2"),
   ]) Test.run(t);
-  
+
   Test.report();
 }
-- 
cgit v1.2.3