Block access to ::, ::ffff:0:0, and 0.0.0.0

[annevk]

Fixes #1117.

• At least two implementers are interested (and none opposed):
  • N/A
• Tests are written and can be reviewed and commented upon at:
  • Not testable unfortunately
• Implementation bugs are filed:
  • N/A
• MDN issue is filed: N/A
• The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

---

Preview | Diff

[fogti]

Should this perhaps also include :: (IPv6)?

[MaraJadeLives]

I got concerned when I saw an article on this bug. No offense, but given that y'all haven't patched it yet (thanks for working on this), would this little extension I tried to make for myself help protect me for now, while I wait for your actual, functional fix?
https://github.com/MaraJadeLives/0blocker/tree/main

[annevk]

@fogti I thought that could not be represented due to the way URL parsing works, but it seems I'm mistaken. Will have to look at that some more.

I also realized this fix is incorrect as we should block this after resolving an origin to an IP address, not before.

@MaraJadeLives I'm not sure who you mean by "y'all" but I no longer work for Mozilla. Also, this repository hosts the Fetch standard, not any particular implementation.

[annevk]

@fogti @sysrqb @mozfreddyb @ricea could you all please review? Feel free to nominate others as well.

(I looked into the URL Standard and it does seem to properly deal with :: (which is identical to ::0). I had just forgotten about it.)

[valenting]

I believe this should also block IPv4 mapped ::ffff:0.0.0.0

[annevk]

That would be ::ffff:0:0 normalized. Interesting. Will add.

[mozfreddyb]

I think we might need to include 6to4 which also includes v4 addresses in v6. Would that be 2002::/48?

[sysrqb]

While not directly appropriate for this PR, we should think about adding a similar check as part of response blocking, as well. I'm thinking about some proxying protocols where DNS resolution is performed by the proxy, and the results are similarly undefined in that case.