Related to the Private-network-access-content-settings.patch and how it works

[t-m-w]

Original title: Should kBlockInsecurePrivateNetworkRequests be set in Private-network-access-content-settings.patch?

(discussion broadened so title changed)

Currently it (and a friend) is set in this patch:

cromite/build/patches/Revert-removal-of-execution-context-address-space.patch

Line 64 in 4cf08e3

+SET_CROMITE_FEATURE_ENABLED(kBlockInsecurePrivateNetworkRequests);

[uazo]

I do not understand the question.

[t-m-w]

No worries!

On a related note, do you have any recommendations for how to test this feature / sites that do local network scans or something?

[uazo]

I would make an A record pointing to a local ip and then a fetch to that host from a website.
if you do, let me know.
for official tests see content/browser/renderer_host/private_network_access_browsertest.cc

[t-m-w]

Okay, I did try doing what you described with an image, and it does work. The image shows up only when I allow private network access.

I also found a test site: https://samy.pl/webscan

It "finds" many hosts that are not real, but it only finds them on subnets that are real. This seems to happen with or without the site setting turned on.

[uazo]

I don't think it can be a test that can be reused, that script tests tcp port 1337.
if you find another one with a more 'normal' port I can try it.

[t-m-w]

Sorry for the delay. I don't know of another, but it is open-source and could be modified and rehosted if needed. https://github.com/samyk/webscan

Apparently, at least on my LAN, regardless of the use of port 1337, there are detections for each IP (even unused ones) on accessible local subnets (maybe related to router configuration, I haven't checked).