Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False-positive on a rule that targets "chrome-extension://${id}" #6

Closed
ameshkov opened this issue Jan 28, 2024 · 4 comments
Closed
Labels
bug Something isn't working

Comments

@ameshkov
Copy link
Member

@@||evernote.com^$domain=pioclpoplcdbaefihamjohnefbikjilc

@ameshkov ameshkov added the bug Something isn't working label Jan 28, 2024
@scripthunter7
Copy link
Member

scripthunter7 commented Jan 29, 2024

@ameshkov We already have a basic domain validator in AGTree

I recommend improving this utility in the following aspects (new methods):

  • validation of domains without wildcards (like wildcard TLD) and check known TLDs
  • add method for IPs

We may can import known TLDs to a Set from here

@ameshkov
Copy link
Member Author

I actually specifically don't use a normal validation, it's okay to check invalid domain names too as the tool then will suggest to remove them.

We just need to exclude some things like IP addresses when it does not make sense to check them.

@Alex-302
Copy link
Member

Alex-302 commented Jan 29, 2024

IP addresses when it does not make sense to check them

at least ping check can be performed. No response = dead.
Also response can be checked:

curl -I -s -X GET http://45.141.56.28/ | grep -i "HTTP/1.1"
=> HTTP/1.1 301 Moved Permanently / 302. But not HTTP/1.1 403 Forbidden.

@ameshkov
Copy link
Member Author

curl -I -s -X GET http://45.141.56.28/ | grep -i "HTTP/1.1"
=> HTTP/1.1 301 Moved Permanently / 302. But not HTTP/1.1 403 Forbidden.

There're more cases than this one.

First of all, there could be $network rules that can be for different ports/protocols.
Also, even when we deal with basic rules, it could be HTTPS like https://1.1.1.1.

But not HTTP/1.1 403 Forbidden

This is a working IP address, what's wrong with it.
It could be answering 403 to one request and respond with 200 OK to a different one for instance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

3 participants