Headline
CVE-2022-47932: Merge pull request #14211 from brave/brave_24093 · brave/brave-core@e733096
Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.
@@ -117,6 +117,61 @@ TEST_F(IPFSRedirectNetworkDelegateHelperTest, EXPECT_EQ(brave_request_info->blocked_by, brave::kOtherBlocked); }
TEST_F(IPFSRedirectNetworkDelegateHelperTest, LoadDisabledWhenIPFS_WhenWrongIPFSUrl) { profile()->GetPrefs()->SetInteger( kIPFSResolveMethod, static_cast<int>(IPFSResolveMethodTypes::IPFS_LOCAL));
// IPFS Subframe { GURL url(“ipfs://10.10.10.1”); auto brave_request_info = std::make_shared<brave::BraveRequestInfo>(url); brave_request_info->resource_type = blink::mojom::ResourceType::kSubFrame; brave_request_info->browser_context = profile(); int rc = ipfs::OnBeforeURLRequest_IPFSRedirectWork( brave::ResponseCallback(), brave_request_info); EXPECT_EQ(rc, net::OK); ASSERT_EQ(brave_request_info->blocked_by, brave::kOtherBlocked); }
// IPFS Mainframe { GURL url(“ipfs://10.10.10.1”); auto brave_request_info = std::make_shared<brave::BraveRequestInfo>(url); brave_request_info->resource_type = blink::mojom::ResourceType::kMainFrame; brave_request_info->browser_context = profile(); int rc = ipfs::OnBeforeURLRequest_IPFSRedirectWork( brave::ResponseCallback(), brave_request_info); EXPECT_EQ(rc, net::OK); ASSERT_EQ(brave_request_info->blocked_by, brave::kOtherBlocked); }
// IPNS Subframe { GURL url(“ipns://10.10.10.1”); auto brave_request_info = std::make_shared<brave::BraveRequestInfo>(url); brave_request_info->resource_type = blink::mojom::ResourceType::kSubFrame; brave_request_info->browser_context = profile(); int rc = ipfs::OnBeforeURLRequest_IPFSRedirectWork( brave::ResponseCallback(), brave_request_info); EXPECT_EQ(rc, net::OK); ASSERT_EQ(brave_request_info->blocked_by, brave::kOtherBlocked); }
// IPFS Mainframe { GURL url(“ipns://10.10.10.1”); auto brave_request_info = std::make_shared<brave::BraveRequestInfo>(url); brave_request_info->resource_type = blink::mojom::ResourceType::kMainFrame; brave_request_info->browser_context = profile(); int rc = ipfs::OnBeforeURLRequest_IPFSRedirectWork( brave::ResponseCallback(), brave_request_info); EXPECT_EQ(rc, net::OK); // It is correct ipns url. ASSERT_EQ(brave_request_info->blocked_by, brave::kNotBlocked); } }
TEST_F(IPFSRedirectNetworkDelegateHelperTest, SubFrameRequestDisabledWhen_NoContext) { profile()->GetPrefs()->SetInteger(