github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-07 20:51:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

Gateway: harden trusted proxy X-Forwarded-For parsing (#22429)

Browse Source
This commit is contained in:
Vincent Koc
2026-02-20 23:59:20 -05:00
committed by GitHub
parent 35be87b09b
commit 07039dc089
3 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/gateway/net.test.ts
View File

@@ -145,12 +145,21 @@ describe("resolveGatewayClientIp", () => {
it("returns forwarded client IP when the remote is a trusted proxy", () => {
const ip = resolveGatewayClientIp({
remoteAddr: "127.0.0.1",
forwardedFor: "10.0.0.2, 127.0.0.1",
forwardedFor: "127.0.0.1, 10.0.0.2",
trustedProxies: ["127.0.0.1"],
});
expect(ip).toBe("10.0.0.2");
});
it("does not trust the left-most X-Forwarded-For value when behind a trusted proxy", () => {
const ip = resolveGatewayClientIp({
remoteAddr: "127.0.0.1",
forwardedFor: "198.51.100.99, 10.0.0.9, 127.0.0.1",
trustedProxies: ["127.0.0.1"],
});
expect(ip).toBe("127.0.0.1");
});
it("fails closed when trusted proxy headers are missing", () => {
const ip = resolveGatewayClientIp({
remoteAddr: "127.0.0.1",

6
src/gateway/net.ts
View File

@@ -147,7 +147,11 @@ function stripOptionalPort(ip: string): string {
}
export function parseForwardedForClientIp(forwardedFor?: string): string | undefined {
const raw = forwardedFor?.split(",")[0]?.trim();
const entries = forwardedFor
?.split(",")
.map((entry) => entry.trim())
.filter((entry) => entry.length > 0);
const raw = entries?.at(-1);
if (!raw) {
return undefined;
}