aghnet: do not turn bad etc/hosts entries into rules

internal/aghnet/hostscontainer.go

@@ -102,14 +102,12 @@ type HostsContainer struct {
 	// embedded to implement MatchRequest and Translate for *HostsContainer.
 	requestMatcher
 
-	// listID is the identifier for the list of generated rules.
-	listID int
-
 	// done is the channel to sign closing the container.
 	done chan struct{}
 
 	// updates is the channel for receiving updated hosts.
 	updates chan *netutil.IPMap
+
 	// last is the set of hosts that was cached within last detected change.
 	last *netutil.IPMap
 
@@ -118,8 +116,12 @@ type HostsContainer struct {
 
 	// w tracks the changes in specified files and directories.
 	w aghos.FSWatcher
+
 	// patterns stores specified paths in the fs.Glob-compatible form.
 	patterns []string
+
+	// listID is the identifier for the list of generated rules.
+	listID int
 }
 
 // ErrNoHostsPaths is returned when there are no valid paths to watch passed to
@@ -309,24 +311,40 @@ func (hp *hostsParser) parseLine(line string) (ip net.IP, hosts []string) {
 		return nil, nil
 	}
 
+	var hostFields []string
 	for _, f := range fields[1:] {
 		switch hashIdx := strings.IndexByte(f, '#'); hashIdx {
 		case -1:
-			hosts = append(hosts, f)
+			// No comments, just a host.
+			hostFields = append(hostFields, f)
 
 			continue
 		case 0:
-			// Go on.
+			// The first field that is a comment.  Go on.
 		default:
 			// Only a part of the field is a comment.
-			hosts = append(hosts, f[:hashIdx])
+			hostFields = append(hostFields, f[:hashIdx])
 		}
 
-		// The rest of the fields are a part of the comment so skip
-		// immediately.
+		// The rest of the fields are a part of the comment so go on to validate
+		// the hosts.
 		break
 	}
 
+	// Make sure that invalid hosts aren't turned into rules.
+	//
+	// See https://github.com/AdguardTeam/AdGuardHome/issues/3946.
+	for _, h := range hostFields {
+		err := netutil.ValidateDomainName(h)
+		if err != nil {
+			log.Error("%s: host %q is invlaid, ignoring", hostsContainerPref, h)
+
+			continue
+		}
+
+		hosts = append(hosts, h)
+	}
+
 	return ip, hosts
 }
 

internal/aghnet/testdata/etc_hosts

@@ -8,7 +8,13 @@
 # See https://github.com/AdguardTeam/AdGuardHome/issues/3846.
 1.0.0.2 a.whole lot.of aliases for.testing
 
+# See https://github.com/AdguardTeam/AdGuardHome/issues/3946.
+1.0.0.3 *
+1.0.0.4 *.com
+
 # Same for IPv6.
 ::1 simplehost
 ::  hello hello.world
 ::2 a.whole lot.of aliases for.testing
+::3 *
+::4 *.com