fix: add response.ok check and URL encoding in DoH lookups

Agent-Logs-Url: https://github.com/trakt/trakt-web/sessions/75aeca43-7a44-4596-9071-51045b3fac26

Co-authored-by: Marius-TV <516291+Marius-TV@users.noreply.github.com>

Author: 2 people

projects/client/src/lib/features/bot-verification/utils/isLegitimateBot.spec.ts

@@ -17,6 +17,7 @@ function makeFetchMock(
     const urlStr = String(url);
     if (urlStr.includes('type=PTR')) {
       return Promise.resolve({
+        ok: true,
         json: () =>
           Promise.resolve({
             Answer: ptrHostname
@@ -26,6 +27,7 @@ function makeFetchMock(
       });
     }
     return Promise.resolve({
+      ok: true,
       json: () =>
         Promise.resolve({
           Answer: aAddress ? [{ data: aAddress }] : undefined,
@@ -114,4 +116,12 @@ describe('isLegitimateBot', () => {
     );
     expect(await isLegitimateBot(GOOGLEBOT_UA, '66.249.77.140')).toBe(false);
   });
+
+  it('should return false when the DoH endpoint returns a non-OK response', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue({ ok: false, status: 503 }),
+    );
+    expect(await isLegitimateBot(GOOGLEBOT_UA, '66.249.77.140')).toBe(false);
+  });
 });

projects/client/src/lib/features/bot-verification/utils/isLegitimateBot.ts

@@ -23,11 +23,16 @@ function identifyBotType(userAgent: string): BotType | null {
 
 async function reverseIpLookup(ip: string): Promise<string> {
   const ptr = ip.split('.').reverse().join('.') + '.in-addr.arpa';
-  const url = `${DOH_ENDPOINT}?name=${ptr}&type=PTR`;
+  const url = `${DOH_ENDPOINT}?name=${encodeURIComponent(ptr)}&type=PTR`;
 
   const response = await fetch(url, {
     headers: { accept: 'application/dns-json' },
   });
+
+  if (!response.ok) {
+    throw new Error(`DNS PTR query failed: ${response.status}`);
+  }
+
   const data = await response.json<{ Answer?: { data: string }[] }>();
   const hostname = data.Answer?.at(0)?.data?.replace(/\.$/, '');
 
@@ -39,11 +44,16 @@ async function reverseIpLookup(ip: string): Promise<string> {
 }
 
 async function forwardDnsLookup(hostname: string): Promise<string> {
-  const url = `${DOH_ENDPOINT}?name=${hostname}&type=A`;
+  const url = `${DOH_ENDPOINT}?name=${encodeURIComponent(hostname)}&type=A`;
 
   const response = await fetch(url, {
     headers: { accept: 'application/dns-json' },
   });
+
+  if (!response.ok) {
+    throw new Error(`DNS A query failed: ${response.status}`);
+  }
+
   const data = await response.json<{ Answer?: { data: string }[] }>();
   const address = data.Answer?.at(0)?.data;