From 0b2fef24c09408b3d4dbf945872177125e120420 Mon Sep 17 00:00:00 2001 From: Conrad Hoffmann Date: Fri, 6 May 2022 16:46:30 +0200 Subject: [PATCH] Normalize remote address before saving to context One cause for https://todo.sr.ht/~sircmpwn/meta.sr.ht/193 was that code performing this sanitization was in multiple places, and a fix was not applied in all places. There is no reasonable expectation for the port to be present anyways, e.g. if the address is taken from a trusted reverse proxy's header. Hence, perform the normalization here, so that the code doing this in applications can be simplified. Note that this does not yet fix the below ticket, it will just make the fix easier. References: https://todo.sr.ht/~sircmpwn/meta.sr.ht/193 --- server/server.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/server/server.go b/server/server.go index 11cf7c82d8506a6de45dde5019cfe60214cbec2b..887c89fc8ebf593d9275ce988558ee6b1c9f1141 100644 --- a/server/server.go +++ b/server/server.go @@ -193,8 +193,16 @@ func (server *Server) WithDefaultMiddleware() *Server { server.router.Use(middleware.Timeout(timeout)) server.router.Use(func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + var err error + addr := r.RemoteAddr + if net.ParseIP(addr) == nil { + addr, _, err = net.SplitHostPort(addr) + if err != nil { + panic(fmt.Errorf("Invalid remote address: %s", r.RemoteAddr)) + } + } ctx := context.WithValue(r.Context(), serverCtxKey, server) - ctx = context.WithValue(ctx, remoteAddrCtxKey, r.RemoteAddr) + ctx = context.WithValue(ctx, remoteAddrCtxKey, addr) r = r.WithContext(ctx) next.ServeHTTP(w, r) }) @@ -203,6 +211,8 @@ func (server *Server) WithDefaultMiddleware() *Server { return server } +// RemoteAddr returns the remote address for this context. It is guaranteed to +// be valid input for `net.ParseIP()`. func RemoteAddr(ctx context.Context) string { raw, ok := ctx.Value(remoteAddrCtxKey).(string) if !ok {