fen
b99e1bdb27
Per owner decision the optional proxy-header escape hatch is dead config: remove the env var, its plumbing (Config.TrustedIPHeader, SetTrustedIPHeader), and the README row. Rate-limit keying is always the peer address; no client-supplied IP header is ever trusted. Tests updated to assert headers (CF-Connecting-IP included) never influence clientIP.
56 lines
1.7 KiB
Go
56 lines
1.7 KiB
Go
package api
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestClientIPUsesRemoteAddrNotXFF(t *testing.T) {
|
|
r := httptest.NewRequest("POST", "/api/pastes", nil)
|
|
r.RemoteAddr = "203.0.113.7:4432"
|
|
r.Header.Set("X-Forwarded-For", "1.2.3.4, 1.2.3.5, 203.0.113.9")
|
|
r.Header.Set("X-Real-Ip", "203.0.113.10")
|
|
if got := clientIP(r); got != "203.0.113.7" {
|
|
t.Fatalf("clientIP = %q, want peer 203.0.113.7", got)
|
|
}
|
|
}
|
|
|
|
// No client-controlled IP header is ever honored, including proxy-typical
|
|
// ones when set by an attacker.
|
|
func TestClientIPNeverTrustsHeaders(t *testing.T) {
|
|
for _, h := range []struct{ name, val string }{
|
|
{"CF-Connecting-IP", "198.51.100.9"},
|
|
{"X-Forwarded-For", "198.51.100.1"},
|
|
{"X-Real-Ip", "198.51.100.2"},
|
|
} {
|
|
r := httptest.NewRequest("POST", "/api/pastes", nil)
|
|
r.RemoteAddr = "10.0.1.47:9999"
|
|
r.Header.Set(h.name, h.val)
|
|
if got := clientIP(r); got != "10.0.1.47" {
|
|
t.Fatalf("%s header: clientIP = %q, want peer 10.0.1.47", h.name, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Issue #280: rotating X-Forwarded-For must NOT reset the bucket. Pentest
|
|
// repro was 8 creates with rotating XFF -> 6x201.
|
|
func TestRotatingXFFDoesNotResetBucket(t *testing.T) {
|
|
globalLimiter = newLimiter()
|
|
s := defaultSettings(Config{})
|
|
var allowed, limited int
|
|
for i := 0; i < 8; i++ {
|
|
r := httptest.NewRequest("POST", "/api/pastes", nil)
|
|
r.RemoteAddr = "198.51.100.1:5000"
|
|
r.Header.Set("X-Forwarded-For", fmt.Sprintf("9.9.9.%d", i))
|
|
if rateLimitCreate(r, s) {
|
|
allowed++
|
|
} else {
|
|
limited++
|
|
}
|
|
}
|
|
if float64(allowed) != s.RateLimitBurst || limited != 8-int(s.RateLimitBurst) {
|
|
t.Fatalf("rotating XFF: allowed=%d limited=%d, want allowed=%v (burst), limited=%d", allowed, limited, s.RateLimitBurst, 8-int(s.RateLimitBurst))
|
|
}
|
|
}
|