From c6c19ae3d43e356374869f2839afb1ddfbb0d53d Mon Sep 17 00:00:00 2001 From: Maksim Kazantsev Date: Mon, 13 Jul 2026 11:58:14 +0300 Subject: [PATCH] filtering: imp answer field validation; --- internal/filtering/rewrites.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/internal/filtering/rewrites.go b/internal/filtering/rewrites.go index 6e9b247e0..812d96c48 100644 --- a/internal/filtering/rewrites.go +++ b/internal/filtering/rewrites.go @@ -10,6 +10,7 @@ import ( "github.com/AdguardTeam/golibs/errors" "github.com/AdguardTeam/golibs/logutil/slogutil" + "github.com/AdguardTeam/golibs/netutil" "github.com/miekg/dns" ) @@ -93,6 +94,14 @@ func (rw *LegacyRewrite) normalize(ctx context.Context, l *slog.Logger) (err err ip, err := netip.ParseAddr(rw.Answer) if err != nil { l.DebugContext(ctx, "normalizing legacy rewrite", slogutil.KeyError, err) + + // Not an IP address, treat as CNAME target, but validate as a domain + // name first. + err = netutil.ValidateDomainName(rw.Answer) + if err != nil { + return fmt.Errorf("invalid CNAME target %q: %w", rw.Answer, err) + } + rw.Type = dns.TypeCNAME return nil