[GH-ISSUE #2909] DNS lookup occurs before blacklist regex check #10222

New Issue

Closed

opened 2026-04-20 13:37:45 -05:00 by GiteaMirror · 1 comment

GiteaMirror commented 2026-04-20 13:37:45 -05:00

Owner

Copy Link

Originally created by @viglianesed on GitHub (Nov 10, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2909

Originally assigned to: @BlackDex on GitHub.

Subject of the issue

Vaultwarden server does a DNS lookup before checking the icon blacklist regex. https://github.com/dani-garcia/vaultwarden/blob/main/src/api/icons.rs#L264

This could cause deanonymization of the server owner/users.

Deployment environment

• vaultwarden version: 1.26.0

• Install method: Docker

• Clients used: n/a

• Reverse proxy and version: n/a

• MySQL/MariaDB or PostgreSQL version: n/a

• Other relevant details: n/a

Steps to reproduce

A network DNS filtering solution like Pi-hole is recomended or any solution that logs DNS traffic.

1. Configure config.json with "icon_blacklist_regex": "'^(.*\\.onion/.*)$'", or in the admin page, set Icon blacklist Regex to '^(.*\.onion/.*)$'
2. Create a new password with some .onion url like -> http://1234567890.testing.dns.blacklist.onion/

Expected behaviour

For privacy reasons, the lookup_host((domain, 0)).await should happen after the regex check.

Actual behaviour

The regex part works and it doesn't contact the actual server:

[2022-11-10 21:26:19.449][vaultwarden::api::icons][WARN] Unable to download icon: Domain is blacklisted. 1234567890.testing.dns.blacklist.onion

The issue is that some user's may not filter .onion DNS requests, so the DNS requests will be sent to the upstream DNS server where they will be most likely logged and identify the user as a Tor user.

Troubleshooting data

Screenshot of a blocked DNS query:

Screenshot of the DNS regex blacklist rule:

Originally created by @viglianesed on GitHub (Nov 10, 2022). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2909 Originally assigned to: @BlackDex on GitHub. <!-- # ### NOTE: Please update to the latest version of vaultwarden before reporting an issue! This saves you and us a lot of time and troubleshooting. See: * https://github.com/dani-garcia/vaultwarden/issues/1180 * https://github.com/dani-garcia/vaultwarden/wiki/Updating-the-vaultwarden-image # ### --> <!-- Please fill out the following template to make solving your problem easier and faster for us. This is only a guideline. If you think that parts are unnecessary for your issue, feel free to remove them. Remember to hide/redact personal or confidential information, such as passwords, IP addresses, and DNS names as appropriate. --> ### Subject of the issue <!-- Describe your issue here. --> Vaultwarden server does a DNS lookup before checking the icon blacklist regex. https://github.com/dani-garcia/vaultwarden/blob/main/src/api/icons.rs#L264 This could cause deanonymization of the server owner/users. ### Deployment environment <!-- ========================================================================================= Preferably, use the `Generate Support String` button on the admin page's Diagnostics tab. That will auto-generate most of the info requested in this section. ========================================================================================= --> <!-- The version number, obtained from the logs (at startup) or the admin diagnostics page --> <!-- This is NOT the version number shown on the web vault, which is versioned separately from vaultwarden --> <!-- Remember to check if your issue exists on the latest version first! --> * vaultwarden version: 1.26.0 <!-- How the server was installed: Docker image, OS package, built from source, etc. --> * Install method: Docker * Clients used: <!-- web vault, desktop, Android, iOS, etc. (if applicable) --> n/a * Reverse proxy and version: <!-- if applicable --> n/a * MySQL/MariaDB or PostgreSQL version: <!-- if applicable --> n/a * Other relevant details: n/a ### Steps to reproduce <!-- Tell us how to reproduce this issue. What parameters did you set (differently from the defaults) and how did you start vaultwarden? --> A network DNS filtering solution like Pi-hole is recomended or any solution that logs DNS traffic. 1. Configure config.json with `"icon_blacklist_regex": "'^(.*\\.onion/.*)$'",` or in the admin page, set `Icon blacklist Regex` to `'^(.*\.onion/.*)$'` 2. Create a new password with some `.onion` url like -> `http://1234567890.testing.dns.blacklist.onion/` ### Expected behaviour <!-- Tell us what you expected to happen --> For privacy reasons, the `lookup_host((domain, 0)).await` should happen after the regex check. ### Actual behaviour <!-- Tell us what actually happened --> The regex part works and it doesn't contact the actual server: ``` [2022-11-10 21:26:19.449][vaultwarden::api::icons][WARN] Unable to download icon: Domain is blacklisted. 1234567890.testing.dns.blacklist.onion ``` The issue is that some user's may not filter `.onion` DNS requests, so the DNS requests will be sent to the upstream DNS server where they will be most likely logged and identify the user as a Tor user. ### Troubleshooting data <!-- Share any log files, screenshots, or other relevant troubleshooting data --> Screenshot of a blocked DNS query:  Screenshot of the DNS regex blacklist rule: 

GiteaMirror added the enhancement label 2026-04-20 13:37:45 -05:00

GiteaMirror closed this issue 2026-04-20 13:37:46 -05:00

GiteaMirror commented 2026-04-20 13:37:48 -05:00

Author

Owner

Copy Link

@BlackDex commented on GitHub (Nov 10, 2022):

Thanks for your report.
I understand the issue, and i also think it is easy to resolve.

<!-- gh-comment-id:1310997699 --> @BlackDex commented on GitHub (Nov 10, 2022): Thanks for your report. I understand the issue, and i also think it is easy to resolve.

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

revert-7033-patch-1

cached-config-operations

test_dylint

1.36.0

1.35.8

1.35.7

1.35.6

1.35.5

1.35.4

1.35.3

1.35.2

1.35.1

1.35.0

1.34.3

1.34.2

1.34.1

1.34.0

1.33.2

1.33.1

1.33.0

1.32.7

1.32.6

1.32.5

1.32.4

1.32.3

1.32.2

1.32.1

1.32.0

1.31.0

1.30.5

1.30.4

1.30.3

1.30.2

1.30.1

1.30.0

1.29.2

1.29.1

1.29.0

1.28.1

1.28.0

1.27.0

1.26.0

1.25.2

1.25.1

1.25.0

1.24.0

1.23.1

1.23.0

1.22.2

1.22.1

1.22.0

1.21.0

1.20.0

1.19.0

1.18.0

1.17.0

1.16.3

1.16.2

1.16.1

1.16.0

1.15.1

1.15.0

1.14.2

1.14.1

1.14

1.13.1

1.13.0

1.12.0

1.11.0

1.10.0

1.9.1

1.9.0

1.8.0

1.7.0

1.6.1

1.6.0

1.5.0

1.4.0

1.3.0

1.2.0

1.1.0

1.0.0

0.13.0

0.12.0

0.11.0

0.10.0

0.9.0

Labels

Clear labels

better for forum

bug

documentation

duplicate

enhancement

future Vault

good first issue

help wanted

low priority

notes

pull-request

Mirrored from GitHub Pull Request

question

SSO

Third party

troubleshooting

wontfix

No Label enhancement

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

GiteaMirror ninjasurge

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#10222