PAC-C004 · dnsdomainis-with-glob

Wildcard characters in dnsDomainIs or localHostOrDomainIs

medium · Correctness

dnsDomainIs and localHostOrDomainIs compare strings literally. "*.corp.example" is looked for as the literal characters *.corp.example, which no hostname contains.

Why it matters

Only shExpMatch understands * and ?. dnsDomainIs(host, "*.corp.example") asks whether host ends with the eight characters *.corp.example; DNS names cannot contain *, so the answer is always no. The branch is dead and traffic goes to the default route. The confusion comes from mixing the two functions’ syntaxes.

How to fix

Use dnsDomainIs(host, ".corp.example") (plain suffix) or shExpMatch(host, "*.corp.example") (glob).

Examples

function FindProxyForURL(url, host) {
  if (dnsDomainIs(host, "*.corp.example")) {
    return "DIRECT";
  }
  return "PROXY proxy.corp.example:8080";
}

function FindProxyForURL(url, host) {
  if (dnsDomainIs(host, ".corp.example")) {
    return "DIRECT";
  }
  return "PROXY proxy.corp.example:8080";
}

Engine behaviour

Source: code = read in the engine's source, doc = vendor documentation, lab = observed in a lab run, expert = practitioner knowledge, not yet verified.

Related rules

• dnsDomainIs pattern without a leading dot matches look-alike domains PAC-X003
• Path, port or query characters in a host pattern PAC-C003

References

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file#dnsdomainis