RequestPolicy/requestpolicy — Issue #114: block requests from public IP addresses to private IP addresses
Author: jsamuel
Created: 2011-12-22 18:53:30+00:00
State: open
Labels: extension

imported trac ticket
created: 2010-06-19 09:51:04
reporter: justin

Some of the [http://ha.ckers.org/blog/20090117/request-policy-firefox-extention first feedback] RP received was that it doesn't offer protection in its default mode against CSRF to RFC 1918 addresses. For example, if one is using the strictness level of base domain, a site can embed an image that is served from a subdomain whose dns resolves to 192.168.1.1.

Solving this in RP directly is difficult without causing performance problems. This is because when RP gets to decide whether to cancel a request, it is at a time where it shouldn't be blocking on DNS resolution.
More info in the existing bugzilla ticket for solving this in Firefox itself:
https://bugzilla.mozilla.org/show_bug.cgi?id=354493