') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); WasmAppHost: block port# 5060 and 5061, for the webserver by kasperk81 · Pull Request #76485 · dotnet/runtime · GitHub
Skip to content

WasmAppHost: block port# 5060 and 5061, for the webserver - #76485

Merged
marek-safar merged 5 commits into
dotnet:mainfrom
kasperk81:patch-3
Oct 4, 2022
Merged

WasmAppHost: block port# 5060 and 5061, for the webserver#76485
marek-safar merged 5 commits into
dotnet:mainfrom
kasperk81:patch-3

Conversation

@kasperk81

@kasperk81kasperk81 commented Oct 1, 2022

Copy link
Copy Markdown
Contributor

@ghost

ghost commented Oct 1, 2022

Copy link
Copy Markdown

I couldn't figure out the best area label to add to this PR. If you have write-permissions please help me learn by adding exactly one area label.

@ghostghost added the community-contribution Indicates that the PR has been added by a community member label Oct 1, 2022
@filipnavara

filipnavara commented Oct 1, 2022

Copy link
Copy Markdown
Member

You don't need to loop. It's easy to just specify smaller range and +2 to the result if it's >= 5060.

@kasperk81

kasperk81 commented Oct 1, 2022

Copy link
Copy Markdown
ContributorAuthor

this is future-proof for additional port blocking

@filipnavara

filipnavara commented Oct 1, 2022•
edited
Loading

Copy link
Copy Markdown
Member

You can apply the same idea in a generic way. Just subtract the size of the array of the blocked ports from the random range. Then loop over the array of blocked ports and increment the random number R by 1 for each array[i] >= R.

@ghost

ghost commented Oct 1, 2022

Copy link
Copy Markdown

Tagging subscribers to this area: @directhex
See info in area-owners.md if you want to be subscribed.

Issue Details

to avoid slipstream attack https://chromestatus.com/feature/5064283639513088

Author:kasperk81
Assignees:-
Labels:

area-Infrastructure-mono, community-contribution

Milestone:-

@pavelsavara

pavelsavara commented Oct 3, 2022•
edited
Loading

Copy link
Copy Markdown
Member

Could you please add comment on why we are avoiding the ports ? Also see what browsers consider unsafe
#76236 (comment)

@kasperk81

kasperk81 commented Oct 3, 2022

Copy link
Copy Markdown
ContributorAuthor

comments added.

Also see what browsers consider unsafe #76236 (comment)

combination of those lists in case it is needed:

1,// tcpmux7,// echo9,// discard11,// systat13,// daytime15,// netstat17,// qotd19,// chargen20,// FTP-data21,// FTP-control22,// SSH23,// telnet25,// SMTP37,// time42,// name43,// nicname53,// domain69,// TFTP77,// priv-rjs79,// finger87,// ttylink95,// supdup101,// hostriame102,// iso-tsap103,// gppitnp104,// acr-nema109,// POP2110,// POP3111,// sunrpc113,// auth115,// SFTP117,// uucp-path119,// nntp123,// NTP135,// loc-srv / epmap137,// NetBIOS139,// netbios143,// IMAP2161,// SNMP179,// BGP389,// LDAP427,// SLP (Also used by Apple Filing Protocol)465,// SMTP+SSL512,// print / exec513,// login514,// shell515,// printer526,// tempo530,// courier531,// Chat532,// netnews540,// UUCP548,// afpovertcp [Apple addition]554,// rtsp556,// remotefs563,// NNTP+SSL587,// ESMTP601,// syslog-conn636,// LDAP+SSL989,// ftps-data990,// ftps993,// IMAP+SSL995,// POP3+SSL1719,// H323 (RAS)1720,// H323 (Q931)1723,// H323 (H245)2049,// NFS3659,// apple-sasl / PasswordServer [Apple addition]4045,// lockd5060,// SIP5061,// SIPS6000,// X116566,// SANE6665,// Alternate IRC [Apple addition]6666,// Alternate IRC [Apple addition]6667,// Standard IRC [Apple addition]6668,// Alternate IRC [Apple addition]6669,// Alternate IRC [Apple addition]6697,// IRC+SSL [Apple addition]10080,// amanda4190,// ManageSieve [Apple addition]6679,// Alternate IRC SSL [Apple addition]

pavelsavara
pavelsavara approved these changes Oct 3, 2022
View reviewed changes

@pavelsavarapavelsavara left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after whitespace fix

@radicalradical added the arch-wasm WebAssembly architecture label Oct 4, 2022
@ghost

ghost commented Oct 4, 2022

Copy link
Copy Markdown

Tagging subscribers to 'arch-wasm': @lewing
See info in area-owners.md if you want to be subscribed.

Issue Details

to avoid slipstream attack https://chromestatus.com/feature/5064283639513088

Author:kasperk81
Assignees:-
Labels:

arch-wasm, area-Build-mono, community-contribution

Milestone:-

@radicalradical changed the title block port# 5060 and 5061WasmAppHost: block port# 5060 and 5061, for the webserverOct 4, 2022
@marek-safar
marek-safar merged commit 1281a4a into dotnet:mainOct 4, 2022
@kasperk81kasperk81 mentioned this pull request Oct 4, 2022
Closed
@ghostghost locked as resolved and limited conversation to collaborators Nov 3, 2022
@kasperk81
kasperk81 deleted the patch-3 branch September 23, 2024 23:10
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@radicalradicalradical approved these changes
@pavelsavarapavelsavarapavelsavara approved these changes
@lewinglewingAwaiting requested review from lewinglewing is a code owner

Assignees

No one assigned

Labels

arch-wasmWebAssembly architecturearea-Build-monocommunity-contributionIndicates that the PR has been added by a community member

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@kasperk81@filipnavara@pavelsavara@radical@marek-safar@jkotas