root/golib
1
0
Fork 0
mirror of https://github.com/therootcompany/golib.git synced 2026-11-04 06:55:00 +00:00
Code Issues Projects Releases Wiki Activity

fix(form2mail): trust RFC1918 proxies (TLS router is on private network)

Browse Source
This commit is contained in:
AJ ONeal 2026-04-21 00:24:17 -06:00
parent 271b22fa1f
commit 8ba1ba91b6
No known key found for this signature in database
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cmd/form2mail/form2mail.go
View File

@ -272,11 +272,16 @@ func main() {
// format, missing field) still show the real support email so users
// know where to write in.
HiddenSupportValue: "[REDACTED]",
// Only honor X-Forwarded-For from loopback (our reverse proxy runs
// on the same host). Prevents spoofing rate limits and geo-gating.
// Honor X-Forwarded-For from loopback (dev/ssh-tunnel) and RFC1918
// ranges (the TLS router lives on a private 10.x / 172.16.x address
// and fronts this service). Any other peer has XFF ignored, so a
// direct public request can't forge its origin IP.
TrustedProxies: []netip.Prefix{
netip.MustParsePrefix("127.0.0.0/8"),
netip.MustParsePrefix("::1/128"),
netip.MustParsePrefix("10.0.0.0/8"),
netip.MustParsePrefix("172.16.0.0/12"),
netip.MustParsePrefix("192.168.0.0/16"),
},
Blacklist: blacklist,
Geo: geo,