de.yaacc.share.LinkTargetPolicy Class Reference

Which http/https link targets the share intake accepts. More...

Collaboration diagram for de.yaacc.share.LinkTargetPolicy:

Static Public Member Functions
static boolean	isAllowedTarget (String url, Set< String > ownAddresses)

Detailed Description

Which http/https link targets the share intake accepts.

Plain Java, no android.*.

A shared link is fetched by the phone (through the media proxy) or played from the phone, so a hostile link must not point the phone at itself or at link-local addresses (cloud metadata style endpoints, the loopback services of other apps). Private LAN ranges stay allowed: the typical share is a NAS or a media server.

The host is taken from the text by hand: no URL, URI or InetAddress, so nothing is resolved and no DNS request is made. Rejected (fail closed):

• not http/https (see HttpLinkTarget#isFetchable(String));
• an empty host, an empty label, a bad port, a backslash in the authority, a percent sign in the host, characters that are not valid in a host name, a host over 253 chars;
• IPv4 loopback 127.0.0.0/8, 0.0.0.0/8 (includes the unspecified address), link-local 169.254.0.0/16; IPv6 ::1, ::, fe80::/10, and IPv4 addresses hidden in IPv6 (mapped ::ffff:a.b.c.d, the deprecated compatible form ::a.b.c.d, NAT64 64:ff9b::a.b.c.d); a zone id is rejected as a percent sign;
• the host localhost and every *.localhost, any case, with or without a trailing dot;
• every address of the phone itself (ownAddresses, normalized by ProxyAccessPolicy#normalizeAll; host names in that set are ignored);
• every IPv4 spelling that is not strict dotted decimal, because it can encode loopback: 2130706433, 0177.0.0.1, 0x7f.1, 127.1. A host whose last label is numeric (decimal digits, or 0x and hex digits) must be a strict dotted-decimal address (four parts, no leading zeros), else it is rejected;
• Unicode look-alikes: the host is folded with NFKC (full-width digits, the ideographic full stop and similar become ASCII) and, because IDNA drops invisible characters, the ASCII-only part of a non-ASCII host is checked as well. A real international name stays allowed.

The authority is what follows the LAST @ before the first /, ? or #, so http://good@127.0.0.1/ is loopback and http://127.0.0.1:80@evil/ is evil.

Member Function Documentation

isAllowedTarget()

static boolean de.yaacc.share.LinkTargetPolicy.isAllowedTarget ( String url, Set< String > ownAddresses )

static

Parameters

url	the link as text, may be null
ownAddresses	the phone's own IP addresses as text (brackets, zone ids and mapped forms are normalized); may be null

Returns

true if the link may be shared

Referenced by de.yaacc.upnp.UpnpClient.createPlayableItem().

Here is the call graph for this function:

Here is the caller graph for this function:

---

The documentation for this class was generated from the following file:

• /github/workspace/yaacc/src/main/java/de/yaacc/share/LinkTargetPolicy.java