arch/soju
1
0
Fork 0
Code Issues Pull requests 1 Actions Packages Projects Releases Wiki Activity

Only read X-Forwarded-* if remote address is loopback

Browse source
This commit is contained in:
Simon Ser 2020-06-29 18:33:23 +02:00
parent 2c172fa8ca
commit a9887114d5
No known key found for this signature in database
GPG key ID: 0FDE7BE0E88F5E48
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
server.go
View file

@ -151,11 +151,22 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, req *http.Request) {
s.Logger.Printf("failed to serve HTTP connection: %v", err) s.Logger.Printf("failed to serve HTTP connection: %v", err)
return return
} }
isLoopback := false
if host, _, err := net.SplitHostPort(req.RemoteAddr); err == nil {
if ip := net.ParseIP(host); ip != nil {
isLoopback = ip.IsLoopback()
}
}
// Only trust X-Forwarded-* header fields if this is a loopback connection,
// to prevent users from spoofing the remote address
remoteAddr := req.RemoteAddr remoteAddr := req.RemoteAddr
forwardedHost := req.Header.Get("X-Forwarded-For") forwardedHost := req.Header.Get("X-Forwarded-For")
forwardedPort := req.Header.Get("X-Forwarded-Port") forwardedPort := req.Header.Get("X-Forwarded-Port")
if forwardedHost != "" && forwardedPort != "" { if isLoopback && forwardedHost != "" && forwardedPort != "" {
remoteAddr = net.JoinHostPort(forwardedHost, forwardedPort) remoteAddr = net.JoinHostPort(forwardedHost, forwardedPort)
} }
s.handle(newWebsocketIRCConn(conn), remoteAddr) s.handle(newWebsocketIRCConn(conn), remoteAddr)
} }