webtorrent / bittorrent-tracker

🌊 Simple, robust, BitTorrent tracker (client & server) implementation
https://webtorrent.io
MIT License
1.73k stars 315 forks source link

adds handling for x-forwarded-for comma-separated syntax #452

Closed tdjsnelling closed 1 year ago

tdjsnelling commented 1 year ago

What is the purpose of this pull request? (put an "X" next to item)

[ ] Documentation update [X] Bug fix [ ] New feature [ ] Other, please explain:

What changes did you make? (Give an overview)

Added better parsing of the X-Forwarded-For header when trustProxy is enabled.

The X-Forwarded-For header can contain a comma-separated list of IP addresses, the first being the client IP and the rest being the addresses of the proxies that the request passed through.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#syntax

There was no handling for this in the server code, so if a list was passed in the header the IP regex test would fail and the peer doing the announce would not be added to the tracker.

This PR adds handling for when the header contains a comma-separated list, by splitting the header on , and setting the ip property to only the first value.

Which issue (if any) does this pull request address?

None

Is there anything you'd like reviewers to focus on?

I was unable to run the tests on an M1 macbook due to an arch error, so please check tests are passing.

welcome[bot] commented 1 year ago

🙌 Thanks for opening this pull request! You're awesome.

welcome[bot] commented 1 year ago

🎉 Congrats on getting your first pull request landed!

alxhotel commented 1 year ago

Thanks @tdjsnelling!

webtorrent-bot commented 1 year ago

:tada: This PR is included in version 10.0.3 :tada:

The release is available on:

Your semantic-release bot :package::rocket: