Files
gstack/browse
garrytanandGabriel Rondon b34cc829ed D2: one address classifier for navigation literals, DNS answers, redirects and page-driven navigations (#2811)
classifyAddress() in url-validation.ts blocks 169.254.0.0/16 (metadata and
container credential endpoints), 100.100.100.200, fe80::/10 and fc00::/7,
including IPv4-mapped, IPv4-compatible and NAT64 spellings and decimal,
octal and hex IPv4. validateNavigationUrl, the A/AAAA answer check and
session-persist's cookie-domain guard all use it. BrowserManager now checks
every navigation request (redirect hops, link clicks, scripted navigations):
a blocked target resets the tab to about:blank and the write command fails
with the reason. Connection-time DNS rebinding remains out of scope.

Co-authored-by: Gabriel Rondon <grondon@gmail.com>
2026-10-03 20:46:00 +00:00
..