Fix: reject malformed domain rules (#3917)

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: Loyalsoldier <[email protected]>

main.go

@@ -66,6 +66,9 @@ const (
 	ModeAll       string = "all"
 	ModeAllowlist string = "allowlist"
 	ModeDenylist  string = "denylist"
+
+	maxDomainLen int = 253 // Maximum length of a domain name
+	maxLabelLen  int = 63  // Maximum length of a label of a domain name
 )
 
 func makeProtoList(listName string, entries []*Entry) *router.GeoSite {
@@ -208,10 +211,15 @@ func parseEntry(typ, rule string) (*Entry, []string, error) {
 			return entry, nil, fmt.Errorf("invalid regexp %q: %w", parts[0], err)
 		}
 		entry.Value = parts[0]
-	case dlc.RuleTypeDomain, dlc.RuleTypeFullDomain, dlc.RuleTypeKeyword:
+	case dlc.RuleTypeDomain, dlc.RuleTypeFullDomain:
+		entry.Value = strings.ToLower(parts[0])
+		if !validateDomainName(entry.Value) {
+			return entry, nil, fmt.Errorf("invalid domain: %q", entry.Value)
+		}
+	case dlc.RuleTypeKeyword:
 		entry.Value = strings.ToLower(parts[0])
 		if !validateDomainChars(entry.Value) {
-			return entry, nil, fmt.Errorf("invalid domain: %q", entry.Value)
+			return entry, nil, fmt.Errorf("invalid keyword: %q", entry.Value)
 		}
 	default:
 		return entry, nil, fmt.Errorf("unknown rule type: %q", entry.Type)
@@ -310,6 +318,21 @@ func validateDomainChars(domain string) bool {
 	return true
 }
 
+// validateDomainName reports whether the domain is a valid domain name, so that
+// typos like "example..com" or "-example.com" would not be silently built into
+// rules which can never match any domain.
+func validateDomainName(domain string) bool {
+	if !validateDomainChars(domain) || len(domain) > maxDomainLen {
+		return false
+	}
+	for label := range strings.SplitSeq(domain, ".") {
+		if label == "" || len(label) > maxLabelLen || label[0] == '-' || label[len(label)-1] == '-' {
+			return false
+		}
+	}
+	return true
+}
+
 func validateAttrChars(attr string) bool {
 	if attr == "" {
 		return false