search

snapframework / snap-core

Core type definitions (Snap monad, HTTP types, etc) and utilities for web handlers.
http://snapframework.com/
BSD 3-Clause "New" or "Revised" License
317 stars 85 forks source link

Fix handling of X-Forwarded-For. #272

Closed galenhuntington closed 7 years ago

galenhuntington commented 7 years ago

The X_Forwarded_For proxy type isn't handled correctly:

  1. The code attempts to parse a port out of the X-Forwarded-For header. But proxies don't send the port in this header (as far as I know). When sent at all, X-Forwarded-Port is used.

  2. The parsing splits on a : to find the port. This breaks IPv6 addresses, which are colon-separated. So, it interprets the first hextet (such as 2600) as the user IP, and tries to get a decimal port out of the second hextet, which of course is a bad result.

  3. It does parsing even if there is no forwarding header, that is, to the original rqClientAddr. This is inefficient, and also means that IPv6 addresses break even when the request is not forwarded.

This PR fixes these issues, and supports X-Forwarded-Port. I also add a check that X-Forwarded-For is not empty.