Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Send hostname option to webtorrent to mitigate DNS rebinding #13844

Merged
merged 1 commit into from
Apr 18, 2018

Conversation

diracdeltas
Copy link
Member

@diracdeltas diracdeltas commented Apr 16, 2018

fix #12616

complicated test plan:

system setup

  1. in /etc/hosts or your system equivalent, add this entry so that brave.site is mapped to localhost: 127.0.0.1 brave.site
  2. write the following to a file named index.html:
<div id='result'></div>
<script>
    const PORT = '58501' // replace this with $PORT number from later steps
    const serverUrl = `http://brave.site:${PORT}/0`
    fetch(serverUrl).then((response) => {
      response.text().then((text) => result.innerText = text)
    })
</script>
  1. in the directory where index.html is located, start a local HTTP server on port 8000 using python -m SimpleHTTPServer 8000 or equivalent
  2. in your Brave directory, edit js/webtorrent/entry.js to change origin: window.location.origin to origin: '*' (this helps simulate a DNS rebinding attack)

testing the PR

  1. start the browser
  2. go to https://webtorrent.io/torrents/sintel.torrent and click the 'start torrent' button
  3. open devtools and inspect one of the download buttons to get the localhost port that the download is served from
  4. replace $PORT in index.html with the port number you just found
  5. now go to localhost:8000 in the browser
  6. the page should appear blank

Submitter Checklist:

  • Submitted a ticket for my issue if one did not already exist.
  • Used Github auto-closing keywords in the commit message.
  • Added/updated tests for this change (for new code or code which already has tests).
  • Ran git rebase -i to squash commits (if needed).
  • Tagged reviewers and labelled the pull request as needed.
  • Request a security/privacy review as needed. (Ask a Brave employee to help if you cannot access this document.)

Test Plan:

Reviewer Checklist:

  • Request a security/privacy review as needed if one was not already requested.

Tests

  • Adequate test coverage exists to prevent regressions
  • Tests should be independent and work correctly when run individually or as a suite ref
  • New files have MPL2 license header

@diracdeltas diracdeltas requested a review from feross April 16, 2018 22:12
@diracdeltas diracdeltas self-assigned this Apr 16, 2018
@diracdeltas diracdeltas added this to the 0.24.x (Nightly Channel) milestone Apr 16, 2018
@codecov-io
Copy link

codecov-io commented Apr 16, 2018

Codecov Report

Merging #13844 into master will decrease coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master   #13844      +/-   ##
==========================================
- Coverage   56.53%   56.52%   -0.02%     
==========================================
  Files         283      283              
  Lines       28817    28817              
  Branches     4777     4777              
==========================================
- Hits        16293    16289       -4     
- Misses      12524    12528       +4
Flag Coverage Δ
#unittest 56.52% <ø> (-0.02%) ⬇️
Impacted Files Coverage Δ
app/browser/api/ledger.js 62.43% <0%> (-0.18%) ⬇️

Copy link
Contributor

@feross feross left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 💪

@diracdeltas diracdeltas requested a review from jumde April 18, 2018 00:39
@diracdeltas diracdeltas merged commit ab89ff0 into master Apr 18, 2018
@diracdeltas
Copy link
Member Author

master / 0.24.x: ab89ff0

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Security] DNS rebinding attack against webtorrent
4 participants