search

t2bot / matrix-media-repo

Highly configurable multi-domain media repository for Matrix.
https://docs.t2bot.io/matrix-media-repo
MIT License
210 stars 79 forks source link

X-Forwarded-For with proxy addresses is not handled properly #602

Open Scrin opened 3 months ago

Scrin commented 3 months ago

It looks like if one uses a reverse proxy in front of MMR that includes X-Forwarded-For header with possible proxy address(es), MMR does not handle that properly. I believe the issue is here: https://github.com/t2bot/matrix-media-repo/blob/85fabea54375630e4f404ff6ecc8c63fbaa28cdc/api/_routers/03-host_detection.go#L37-L45

If the raddr gets its value from the X-Forwarded-For and the header contains proxy addresses (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#syntax ), then the net.SplitHostPort fails to parse it

Scrin commented 2 months ago

I can fix this, but I'd like to see https://github.com/t2bot/matrix-media-repo/pull/611 merged first to avoid conflicts, as mentioned in the MMR matrix room