From 0fd8bc3eafd2cb9c1f22b32e298f4c85f29a3035 Mon Sep 17 00:00:00 2001
From: Lowder <me@lowderplay.dev>
Date: Thu, 11 Dec 2025 01:23:00 +0500
Subject: [PATCH] fix: whitelist domain depth, exclude subnets from verdict

---
 querying/src/lib.rs                | 12 ++++++------
 website/src/db.rs                  |  3 +++
 website/src/main.rs                |  6 +++++-
 website/templates/result.html.tera |  7 ++++++-
 4 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/querying/src/lib.rs b/querying/src/lib.rs
index 81b0932..6f61ffa 100644
--- a/querying/src/lib.rs
+++ b/querying/src/lib.rs
@@ -32,13 +32,13 @@ pub struct Check {
     pub verdict: CheckVerdict,
     pub geo: IpInfo,
     pub ips: Vec<IpAddr>,
+    pub rkn_subnets: HashSet<IpNet>,
 }
 
 pub enum CheckVerdict {
     Clear,
     Blocked {
         rkn_domain: Option<String>,
-        rkn_subnets: HashSet<IpNet>,
         cdn_provider_subnets: HashMap<String, HashSet<NetworkRecord>>,
     },
 }
@@ -115,14 +115,14 @@ impl Checker {
             .collect();
 
         Ok(Check {
-            verdict: match (domain, cdn_provider_subnets.is_empty(), rkn_subnets.is_empty()) {
-                (None, true, true) => CheckVerdict::Clear,
-                (domain, _, _) => CheckVerdict::Blocked {
+            verdict: match (domain, cdn_provider_subnets.is_empty()) {
+                (None, true) => CheckVerdict::Clear,
+                (domain, _) => CheckVerdict::Blocked {
                     rkn_domain: domain,
-                    rkn_subnets,
                     cdn_provider_subnets,
-                }
+                },
             },
+            rkn_subnets,
             geo,
             ips
         })
diff --git a/website/src/db.rs b/website/src/db.rs
index 436ab1a..fa5699f 100644
--- a/website/src/db.rs
+++ b/website/src/db.rs
@@ -127,6 +127,9 @@ pub async fn check_whitelist(
     domain: &str,
     db: &mut Connection<Db>,
 ) -> Result<Option<WhitelistedEntry>, sqlx::Error> {
+    if domain.chars().filter(|c| *c == '.').count() > 4 {
+        return Ok(None);
+    }
     sqlx::query_as!(
         WhitelistedEntry,
         "SELECT *
diff --git a/website/src/main.rs b/website/src/main.rs
index 1c59ef2..82dbfb4 100644
--- a/website/src/main.rs
+++ b/website/src/main.rs
@@ -135,6 +135,7 @@ async fn check(
             verdict: CheckVerdict::Clear,
             geo,
             ips,
+            rkn_subnets,
         }) => Ok(Template::render(
             "result",
             context! {
@@ -143,6 +144,9 @@ async fn check(
                 found: false,
                 target: target.to_query(),
                 target_type: target.readable_type(),
+                blocked_subnets: rkn_subnets.iter()
+                    .map(|n| n.to_string())
+                    .collect::<Vec<_>>(),
                 whitelist,
                 ips,
                 geo,
@@ -152,10 +156,10 @@ async fn check(
             verdict:
                 CheckVerdict::Blocked {
                     rkn_domain,
-                    rkn_subnets,
                     cdn_provider_subnets,
                 },
             geo,
+            rkn_subnets,
             ips,
         }) => Ok(Template::render(
             "result",
diff --git a/website/templates/result.html.tera b/website/templates/result.html.tera
index 9586544..5cc3672 100644
--- a/website/templates/result.html.tera
+++ b/website/templates/result.html.tera
@@ -107,8 +107,13 @@
                 <div class="detail-row">
                     <span class="row-label">Реестр РКН</span>
 
-                    {% if domain or blocked_subnets %}
+                    {% if domain %}
                         <span class="row-value alert">ОГРАНИЧЕН</span>
+                    {% elif blocked_subnets %}
+                        <span class="row-value alert hint"
+                              title="Адреса пересекаются с подсетями заблокированных доменов (не гарантирует блокировку)">
+                            IP-АДРЕСА
+                        </span>
                     {% else %}
                         <span class="row-value">Не найден</span>
                     {% endif %}