Validate Reject IP size

Build/build-reject-domainset.ts

@@ -189,7 +189,13 @@ export const buildRejectDomainSet = task(require.main === module, __filename)(as
       span.traceChildAsync(
         'get botnet ips',
         () => fetchAssets(...BOTNET_FILTER, true, true)
-      ).then(arr => rejectIPOutput.bulkAddAnyCIDR(arr, false)),
+      ).then(arr => {
+        if (arr.length > 2000) {
+          throw new Error('Too many botnet ips, please check the source of BOTNET_FILTER');
+        }
+        return rejectIPOutput.bulkAddAnyCIDR(arr, false);
+      }),
+
       span.traceChildAsync(
         'get bogus nxdomain ips',
         () => fetchAssets(...BOGUS_NXDOMAIN_DNSMASQ, true, false)
@@ -197,14 +203,17 @@ export const buildRejectDomainSet = task(require.main === module, __filename)(as
             for (let i = 0, len = arr.length; i < len; i++) {
               const line = arr[i];
               if (line.startsWith('bogus-nxdomain=')) {
-                arr[i] = line.slice(15).trim();
+                // bogus nxdomain needs to be blocked even after resolved
+                rejectIPOutput.addAnyCIDR(
+                  line.slice(15).trim(),
+                  false
+                );
               }
             }
 
             return arr;
           })
-        // bogus nxdomain needs to be blocked even after resolved
+      )
-      ).then(arr => rejectIPOutput.bulkAddAnyCIDR(arr, false))
     ].flat()));
 
   if (foundDebugDomain.value) {

Build/lib/rules/base.ts

@@ -250,6 +250,21 @@ export class FileOutput {
     return ip + '/128';
   };
 
+  addAnyCIDR(cidr: string, noResolve = false) {
+    const version = fastIpVersion(cidr);
+    if (version === 0) return this;
+
+    let list: Set<string>;
+    if (version === 4) {
+      list = noResolve ? this.ipcidrNoResolve : this.ipcidr;
+    } else /* if (version === 6) */ {
+      list = noResolve ? this.ipcidr6NoResolve : this.ipcidr6;
+    }
+
+    list.add(FileOutput.ipToCidr(cidr, version));
+    return this;
+  }
+
   bulkAddAnyCIDR(cidrs: string[], noResolve = false) {
     const list4 = noResolve ? this.ipcidrNoResolve : this.ipcidr;
     const list6 = noResolve ? this.ipcidr6NoResolve : this.ipcidr6;