{"issue":{"user":{"id":1240282,"login":"jsamuel","url":"https://api.github.com/users/jsamuel","gravatar_id":"bc1d195cedb959a3946572b08ce9e7c7","avatar_url":"https://secure.gravatar.com/avatar/bc1d195cedb959a3946572b08ce9e7c7?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png"},"milestone":null,"created_at":"2011-12-22T04:01:51Z","title":"block requests from public IP addresses to private IP addresses","updated_at":"2011-12-22T04:01:54Z","labels":[{"name":"extension","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/labels/extension","color":"ededed"}],"state":"open","id":2632989,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"html_url":"https://github.com/RequestPolicy/requestpolicy/issues/114","closed_at":null,"number":114,"body":"Some of the [http://ha.ckers.org/blog/20090117/request-policy-firefox-extention first feedback] RP received was that it doesn't offer protection in its default mode against CSRF to RFC 1918 addresses. For example, if one is using the strictness level of base domain, a site can embed an image that is served from a subdomain whose dns resolves to 192.168.1.1.\r\n\r\nSolving this in RP directly is difficult without causing performance problems. This is because when RP gets to decide whether to cancel a request, it is at a time where it shouldn't be blocking on DNS resolution.\r\nMore info in the existing bugzilla ticket for solving this in Firefox itself:\r\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=354493","url":"https://api.github.com/repos/RequestPolicy/requestpolicy/issues/114","comments":2,"assignee":null},"action":"opened"}