-
Notifications
You must be signed in to change notification settings - Fork 1
fix: normalize domains to ensure FQDN equality #6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
1135789 to
09c55d7
Compare
addaleax
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good, although I imagine we'd more generally like to adopt the current code in https://github.com/mongodb/node-mongodb-native/blob/761b9bfab8dfc8e3e7e311731d7a5cda1285bc6c/src/utils.ts#L1129-L1159
|
@tkxkd0159 Can you look at the linting failures? I think those would be the hard blockers here. Otherwise somebody else can also push updates to this branch |
@addaleax I initially left this logic out and used a lightweight workaround instead. But I agree that it's good to add this logic to prevent short domain DNS spoofing attack. I’ll update the PR accordingly. And there is no |
2fc28ee to
0cc4b97
Compare
|
@addaleax Whenever you have some downtime, I’d appreciate a review on this :) |
|
@tkxkd0159 Sorry for the delay, this has been merged and published now! ✨ |
mongoshuses@mongodb-js/devtools-connect, and@mongodb-js/devtools-connectusesresolve-mongodb-srv. In the current implementation, if you explicitly indicate the FQDN by adding ".", it will be recognized as a different domain. So we need to fix this.