Mozilla performing pdf.js DNS queries?
Hi, Whilst rummaging through some DNS (dnsmasq) logs I've noticed quite a decent amount of queries for pdf.js from what appear to be mozilla browsers. Seems rather odd that it is performing DNS queries for a internal PDF viewer. Has anyone else come across these lookups? Kind regards, Seth
Pdf is quite a standard. One might wonder what it cannot do. One could call it evil. http://superuser.com/questions/368486/link-to-image-within-pdf-and-have-the-... David Hofstee Deliverability Management MailPlus B.V. Netherlands (ESP) -----Oorspronkelijk bericht----- Van: NANOG [mailto:nanog-bounces@nanog.org] Namens Seth Mos Verzonden: Thursday, November 13, 2014 2:26 PM Aan: NANOG list Onderwerp: Mozilla performing pdf.js DNS queries? Hi, Whilst rummaging through some DNS (dnsmasq) logs I've noticed quite a decent amount of queries for pdf.js from what appear to be mozilla browsers. Seems rather odd that it is performing DNS queries for a internal PDF viewer. Has anyone else come across these lookups? Kind regards, Seth
David Hofstee schreef op 13-11-2014 14:39:
Pdf is quite a standard. One might wonder what it cannot do. One could call it evil.
http://superuser.com/questions/368486/link-to-image-within-pdf-and-have-the-...
Ah yes, a image within a PDF could definitely do this I suppose. I just thought it odd that the browser would leak this out. dnsmasq[3151]: query[A] pdf.js from 10.6.24.11 dnsmasq[3151]: query[AAAA] pdf.js from 10.6.24.11 dnsmasq[3151]: query[A] pdf.js from 10.6.24.11 dnsmasq[3151]: query[AAAA] pdf.js from 10.6.24.11 This could become a whole can of worms if a .js TLD ever makes it to the internet and registers this domain name. We see this from Ubuntu terminals running Mozilla Firefox 33.0 Best regards, Seth
David Hofstee
Deliverability Management MailPlus B.V. Netherlands (ESP)
-----Oorspronkelijk bericht----- Van: NANOG [mailto:nanog-bounces@nanog.org] Namens Seth Mos Verzonden: Thursday, November 13, 2014 2:26 PM Aan: NANOG list Onderwerp: Mozilla performing pdf.js DNS queries?
Hi,
Whilst rummaging through some DNS (dnsmasq) logs I've noticed quite a decent amount of queries for pdf.js from what appear to be mozilla browsers.
Seems rather odd that it is performing DNS queries for a internal PDF viewer.
Has anyone else come across these lookups?
Kind regards,
Seth
On Thu, 13 Nov 2014 14:26:28 +0100, Seth Mos said:
Whilst rummaging through some DNS (dnsmasq) logs I've noticed quite a decent amount of queries for pdf.js from what appear to be mozilla browsers.
Seems rather odd that it is performing DNS queries for a internal PDF viewer.
Totally wild shot in the dark - recent Mozilla have an onboard PDF viewer written in javascript called pdf.js http://en.wikipedia.org/wiki/PDF.js It's callable from within other javascript via chrome:// or resource:// references, but sometimes people don't get it right: http://superuser.com/questions/614002/how-to-open-pdf-js-in-firefox-via-chro... My guess is that somebody else didn't quite get it right, and is trying to get to the hostname when they intended to get to the javascript.....
<@darq> 17:40 < ircperson> oof. apparently .prod is a TLD now <@darq> 17:40 < ircperson> and a friend's environment is basically on fire. <@darq> HAHAHA /kc On Thu, Nov 13, 2014 at 12:00:56PM -0500, Valdis.Kletnieks@vt.edu said:
On Thu, 13 Nov 2014 14:26:28 +0100, Seth Mos said:
Whilst rummaging through some DNS (dnsmasq) logs I've noticed quite a decent amount of queries for pdf.js from what appear to be mozilla browsers.
Seems rather odd that it is performing DNS queries for a internal PDF viewer.
Totally wild shot in the dark - recent Mozilla have an onboard PDF viewer written in javascript called pdf.js
http://en.wikipedia.org/wiki/PDF.js
It's callable from within other javascript via chrome:// or resource:// references, but sometimes people don't get it right:
http://superuser.com/questions/614002/how-to-open-pdf-js-in-firefox-via-chro...
My guess is that somebody else didn't quite get it right, and is trying to get to the hostname when they intended to get to the javascript.....
-- Ken Chase - ken@heavycomputing.ca skype:kenchase23 +1 416 897 6284 Toronto Canada Heavy Computing - Clued bandwidth, colocation and managed linux VPS @151 Front St. W.
On Nov 13, 2014, at 8:42 AM, Ken Chase <math@sizone.org> wrote:
<@darq> 17:40 < ircperson> oof. apparently .prod is a TLD now <@darq> 17:40 < ircperson> and a friend's environment is basically on fire. <@darq> HAHAHA
https://www.icann.org/resources/pages/name-collision-2013-12-06-en Regards, -drc
https://bugzilla.mozilla.org/show_bug.cgi?id=1098415 has been filed to track this issue. ~reed On Thu, Nov 13, 2014 at 5:26 AM, Seth Mos <seth.mos@dds.nl> wrote:
Hi,
Whilst rummaging through some DNS (dnsmasq) logs I've noticed quite a decent amount of queries for pdf.js from what appear to be mozilla browsers.
Seems rather odd that it is performing DNS queries for a internal PDF viewer.
Has anyone else come across these lookups?
Kind regards,
Seth
participants (6)
-
David Conrad -
David Hofstee -
Ken Chase -
Reed Loden -
Seth Mos -
Valdis.Kletnieks＠vt.edu