Merge pull request #9967 from nextcloud/backport/9964/stable1.15

[stable1.15] fix(autoconfig): Refactor DNS query for testing

.github/workflows/update-public-suffix-list.yml

@@ -0,0 +1,45 @@
+# SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+# SPDX-License-Identifier: MIT
+name: Update public suffix list
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "5 2 * * *"
+
+jobs:
+  update-public-suffix-list:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        branches: ['main', 'stable3.7']
+
+    name: update-public-suffix-list-${{ matrix.branches }}
+
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+        with:
+          ref: ${{ matrix.branches }}
+          submodules: true
+
+      - name: Download public suffix list
+        run: curl --output resources/resources/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
+
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c
+        with:
+          token: ${{ secrets.COMMAND_BOT_PAT }}
+          commit-message: 'fix(dns): Update public suffix list'
+          committer: GitHub <[email protected]>
+          author: nextcloud-command <[email protected]>
+          signoff: true
+          branch: 'fix/dns/update-public-suffix-list-${{ matrix.branches }}'
+          title: '[${{ matrix.branches }}] fix(dns): Update public suffix list'
+          body: |
+            Auto-generated update of https://publicsuffix.org/
+          labels: |
+            dependencies
+            3. to review
+          reviewers: ChristophWurst

composer.json

@@ -37,6 +37,7 @@
 		"ezyang/htmlpurifier": "4.14.0",
 		"gravatarphp/gravatar": "^2.0",
 		"html2text/html2text": "^4.3",
+		"jeremykendall/php-domain-parser": "^6.1",
 		"nextcloud/horde-managesieve": "^1.0",
 		"nextcloud/horde-smtp": "^1.0",
 		"psr/log": "^1",

lib/Dns/Resolver.php

@@ -0,0 +1,32 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Mail\Dns;
+
+use Pdp\Domain;
+use Pdp\Rules;
+use function dns_get_record;
+
+class Resolver {
+	/**
+	 * @return array|false
+	 */
+	public function resolve(string $hostname, int $type) {
+		return dns_get_record($hostname, $type);
+	}
+
+	public function isSuffix(string $hostname): bool {
+		$publicSuffixList = Rules::fromPath(__DIR__ . '/../../resources/public_suffix_list.dat');
+		$domain = Domain::fromIDNA2008($hostname);
+
+		$result = $publicSuffixList->resolve($domain);
+
+		return $result->secondLevelDomain()->toString() === '';
+	}
+}

lib/Service/AutoConfig/IspDb.php

@@ -27,10 +27,12 @@
 
 use Exception;
 use Horde_Mail_Rfc822_Address;
+use OCA\Mail\Dns\Resolver;
 use OCP\Http\Client\IClient;
 use OCP\Http\Client\IClientService;
 use Psr\Log\LoggerInterface;
 use SimpleXMLElement;
+use function explode;
 use function str_replace;
 use function strtolower;
 
@@ -41,6 +43,7 @@ class IspDb {
 
 	/** @var LoggerInterface */
 	private $logger;
+	private Resolver $dnsResolver;
 
 	/** @returns string[] */
 	public function getUrls(): array {
@@ -53,8 +56,11 @@ public function getUrls(): array {
 		];
 	}
 
-	public function __construct(IClientService $clientService, LoggerInterface $logger) {
+	public function __construct(IClientService $clientService,
+		Resolver $dnsResolver,
+		LoggerInterface $logger) {
 		$this->client = $clientService->newClient();
+		$this->dnsResolver = $dnsResolver;
 		$this->logger = $logger;
 	}
 
@@ -166,11 +172,14 @@ public function query(string $domain, Horde_Mail_Rfc822_Address $email, bool $tr
 			}
 		}
 
-		if ($tryMx && ($dns = dns_get_record($domain, DNS_MX))) {
+		if ($tryMx && ($dns = $this->dnsResolver->resolve($domain, DNS_MX))) {
 			$domain = $dns[0]['target'];
 			if (!($config = $this->query($domain, $email, false))) {
 				[, $domain] = explode('.', $domain, 2);
-				$config = $this->query($domain, $email, false);
+				// Only try second-level domains and deeper
+				if (!$this->dnsResolver->isSuffix($domain)) {
+					$config = $this->query($domain, $email, false);
+				}
 			}
 		}
 		return $config;