feat(parking): host-parked Moshpit names go to the Pit too - #88
Merged
Conversation
#87 moved /parking?name= to the Pit, but that is not how a parked name actually arrives. The DNS resolver points an unpointed name at this app (DEFAULT_PARKING_HOST), so `curl scrambled.eggs` lands here as a Host header and still rendered the "IS COMING" tenant card. A name resolved from the Host now redirects to <pit>/n/<name>, while an ordinary parked clearnet domain renders exactly as before. Which is which is asked of the Pit per name, not by pulling its ending list: that list is capped at 200 and `.eggs` already falls outside it, so matching against it would quietly answer "no" for real names. resolve's `registered` flag has no such ceiling. 307, not 308. The owner can point the name at a real target at any moment; a permanent redirect cached in a browser would keep sending them here long after this app stopped being the answer. /parking keeps its 308 — that URL will always mean "go to the pit". Fails closed: an unreachable Pit answers "not ours", so a registry outage leaves every parked domain rendering as it does today rather than bouncing the whole internet at /n/. Answers are memoised per name behind a 5-minute TTL, with a bounded map because Host is attacker-controlled. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#87 moved
/parking?name=to the Pit — but that isn't how a parked name actually arrives. The DNS resolver points an unpointed name at this app (DEFAULT_PARKING_HOST = moshcoding.com), socurl scrambled.eggslands here as a Host header and still rendered the "IS COMING" tenant card.Change
A name resolved from the Host now redirects to
<pit>/n/<name>. An ordinary parked clearnet domain renders exactly as before.Measured locally against the live registry:
scrambled.eggs307→https://pit.moshcode.sh/n/scrambled.eggshawaiian.chicken307→https://pit.moshcode.sh/n/hawaiian.chickenmoshcode.sh200—<title>Moshcode IS COMING</title>(tenant page, untouched)200— the landing pageThree decisions worth flagging
Asked per name, not by pulling the ending list.
/api/moshpit/tldsis capped at 200 and.eggsalready falls outside it — matching against that list would quietly answer "no" for real names.resolve'sregisteredflag has no such ceiling and means exactly "an ending the pit holds".307, not 308. The owner can point the name at a real target at any moment; a permanent redirect cached in a browser would keep sending visitors here long after this app stopped being the answer.
/parkingkeeps its 308, because that URL will always mean "go to the pit".Fails closed. An unreachable Pit answers "not ours", so a registry outage leaves every parked domain rendering as it does today rather than bouncing the whole internet at
/n/. Answers are memoised per name behind a 5-minute TTL, in a bounded map —Hostis attacker-controlled, so the memo can't be allowed to grow without end.Verification
bun test tests/— 157 pass, 0 fail (9 new), covering ours/not-ours, shape rejection without a request, memoisation, case normalisation, fail-closed on outage and non-200, and warm-cache survivalbun run buildcleanLocationheaders with realHostheaders — the table above is measured🤖 Generated with Claude Code