[Security] [hackerone] adblocking DNS issue

[diracdeltas]

https://hackerone.com/reports/1203842

[diracdeltas]

cc @spylogsster to check whether brave/brave-core#8068 has the same leak

[stephendonner]

I used a special test build from CI: https://brave-jenkins-build-artifacts.s3.amazonaws.com/brave-browser-build-pr/proxy-disable-cname-uncloaking/b35173f457d8429bdeb9a44d956cc7d3f74c3752-0a1d47930bd4f300aab7638446bc44a100cdc478/windows/BraveBrowserStandaloneNightlySetup_91_1_27_39.exe

Brave	1.27.39 Chromium: 91.0.4472.77 (Official Build) nightly (64-bit)
Revision	1cecd5c8a856bc2a5adda436e7b84d8d21b339b6-refs/branch-heads/4472@{#1246}
OS	Windows 10 OS Version 2009 (Build 21390.1010)

Steps:

1. new profile
2. launched Brave
3. installed the NordVPN 2.29.1 extension (https://chrome.google.com/webstore/detail/nordvpn-%E2%80%94-1-vpn-chrome-ex/fjoaledfpmneenckfbpdfhkmimnjocfa)
4. signed in using internal Brave credentials
5. loaded https://test-cname.brave.software/cname-uncloaking.html
6. followed the instructions, and added ||dev-pages.brave.software/static/images/test.jpg to brave://adblock
7. clicked Run test
8. confirmed that the output was Request was allowed
9. also confirmed by re-running the test that DNS-lookup traffic went to NordVPN

CNAME-test output	Wireshark

[LaurenWags]

Labelling as QA/Blocked until there is a 1.26.x build with this fix.

[stephendonner]

Verified PASSED using the inline testplan with build

Brave	1.26.63 Chromium: 91.0.4472.106 (Official Build) (x86_64)
Revision	574f7b38e4e7244c92c4675e902e8f8e3d299ea7-refs/branch-heads/4472@{#1477}
OS	macOS Version 11.4 (Build 20F71)

Steps:

1. new profile
2. launched Brave
3. installed the NordVPN 2.29.1 extension (https://chrome.google.com/webstore/detail/nordvpn-%E2%80%94-1-vpn-chrome-ex/fjoaledfpmneenckfbpdfhkmimnjocfa)
4. signed in using internal Brave credentials
5. loaded https://test-cname.brave.software/cname-uncloaking.html
6. followed the instructions, and added ||dev-pages.brave.software/static/images/test.jpg to brave://adblock
7. clicked Run test
8. confirmed that the output was Request was allowed
9. also confirmed by re-running the test that DNS-lookup traffic went to NordVPN

example	example	example

---

Verification passed on

Brave	1.26.63 Chromium: 91.0.4472.106 (Official Build) (64-bit)
Revision	574f7b38e4e7244c92c4675e902e8f8e3d299ea7-refs/branch-heads/4472@{#1477}
OS	Ubuntu 18.04 LTS

Shields down:

Shields up:
--	--

---

Verification passed on

<!--StartFragment-->
Brave | 1.26.63 Chromium: 91.0.4472.106&nbsp;(Official Build)&nbsp;(64-bit)
-- | --
Revision | 574f7b38e4e7244c92c4675e902e8f8e3d299ea7-refs/branch-heads/4472@{#1477}
OS | Windows&nbsp;10 OS Version 2004 (Build 19041.1052)

<!--EndFragment-->

• Verified the test plan from Avoid CNAME uncloaking if a proxy is configured brave-core#8957
• Verified the steps mentioned by @stephendonner

example	example	example