MiniDNS / minidns

DNS library for Android and Java SE
Other
220 stars 61 forks source link

Sanitize DNS labels (and names) in toString() #115

Closed Flowdalic closed 3 years ago

Flowdalic commented 3 years ago

The c-ares library was recently affected by an issue where a string potentially containing a null byte (and other non-printable characters) was handed to the user (CVE-2021-3672) [1].

We should also at least prevent the user from dealing with Strings containing a null byte (if they don't explicitly ask for it). Therefore, the toString() methods of DnsName and DnsLabel now return a "null-byte safe" String.

1: https://www.openwall.com/lists/oss-security/2021/08/10/1