mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-10-27 18:10:47 -05:00
ea6af0048c
Some checks failed
CodeQL / Analyze (cpp) (push) Has been cancelled
CodeQL / Analyze (actions) (push) Has been cancelled
Build Desktop / Configure (push) Has been cancelled
Build Desktop / Debian 13 (push) Has been cancelled
Build Desktop / Debian 12 (push) Has been cancelled
Build Desktop / Fedora 44 (push) Has been cancelled
Build Desktop / Fedora 43 (push) Has been cancelled
Build Desktop / Servatrice_Debian 12 (push) Has been cancelled
Build Desktop / Ubuntu 24.04 (push) Has been cancelled
Build Desktop / Ubuntu 26.04 (push) Has been cancelled
Build Desktop / Arch (push) Has been cancelled
Build Desktop / Ubuntu 26.04 cover (push) Has been cancelled
Build Desktop / macOS 13 Intel (push) Has been cancelled
Build Desktop / macOS 14 (push) Has been cancelled
Build Desktop / macOS 15 (push) Has been cancelled
Build Desktop / macOS 26 Debug (push) Has been cancelled
Build Desktop / Windows 10 (push) Has been cancelled
Build Desktop / Prune caches (push) Has been cancelled
Build Docker / Servatrice (arm) (push) Has been cancelled
Build Docker / Servatrice (x86) (push) Has been cancelled
Build Docker / Publish multi-platform Servatrice image (push) Has been cancelled
X-Forwarded-For carries a comma-separated list, and constructing a QHostAddress from the raw header value returns a null address for it, so a configured X-Forwarded-For or a multi-hop header never resolved and websocket clients stayed on the proxy's address. - Add parseForwardedAddress, returning the rightmost usable entry of a forwarded header list - Use it for the websocket handshake instead of parsing the raw value - Exempt loopback from per-address auth rate limits so a same-host proxy with a customized trusted_sources list cannot lock every user out - Add forwarded_address_test Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
38 lines
1.3 KiB
C++
38 lines
1.3 KiB
C++
#include "forwarded_address.h"
|
|
|
|
#include "gtest/gtest.h"
|
|
|
|
namespace
|
|
{
|
|
|
|
TEST(ForwardedAddressTest, ParsesSingleAddress)
|
|
{
|
|
EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("203.0.113.7"));
|
|
EXPECT_EQ(QHostAddress("::1"), parseForwardedAddress("::1"));
|
|
EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress(" 203.0.113.7 "));
|
|
}
|
|
|
|
TEST(ForwardedAddressTest, UsesRightmostEntryOfAList)
|
|
{
|
|
// nginx's $proxy_add_x_forwarded_for appends its own view of the client to
|
|
// whatever the client sent, so only the trailing entry is trustworthy.
|
|
EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("198.51.100.9, 203.0.113.7"));
|
|
EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("spoofed.invalid, 203.0.113.7"));
|
|
EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("203.0.113.7, "));
|
|
}
|
|
|
|
TEST(ForwardedAddressTest, KeepsIpv4MappedEntries)
|
|
{
|
|
EXPECT_EQ(QHostAddress("::ffff:203.0.113.7"), parseForwardedAddress("::ffff:203.0.113.7"));
|
|
}
|
|
|
|
TEST(ForwardedAddressTest, RejectsValuesWithoutAnAddress)
|
|
{
|
|
EXPECT_TRUE(parseForwardedAddress("").isNull());
|
|
EXPECT_TRUE(parseForwardedAddress(",").isNull());
|
|
EXPECT_TRUE(parseForwardedAddress("unknown").isNull());
|
|
EXPECT_TRUE(parseForwardedAddress("garbage, more garbage").isNull());
|
|
}
|
|
|
|
} // namespace
|