From 8ba1ba91b60f08d6b5b56d8e563031ad7117ae13 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Tue, 21 Apr 2026 00:24:17 -0600 Subject: [PATCH] fix(form2mail): trust RFC1918 proxies (TLS router is on private network) --- cmd/form2mail/form2mail.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/cmd/form2mail/form2mail.go b/cmd/form2mail/form2mail.go index f87cedf..8e1e19f 100644 --- a/cmd/form2mail/form2mail.go +++ b/cmd/form2mail/form2mail.go @@ -272,11 +272,16 @@ func main() { // format, missing field) still show the real support email so users // know where to write in. HiddenSupportValue: "[REDACTED]", - // Only honor X-Forwarded-For from loopback (our reverse proxy runs - // on the same host). Prevents spoofing rate limits and geo-gating. + // Honor X-Forwarded-For from loopback (dev/ssh-tunnel) and RFC1918 + // ranges (the TLS router lives on a private 10.x / 172.16.x address + // and fronts this service). Any other peer has XFF ignored, so a + // direct public request can't forge its origin IP. TrustedProxies: []netip.Prefix{ netip.MustParsePrefix("127.0.0.0/8"), netip.MustParsePrefix("::1/128"), + netip.MustParsePrefix("10.0.0.0/8"), + netip.MustParsePrefix("172.16.0.0/12"), + netip.MustParsePrefix("192.168.0.0/16"), }, Blacklist: blacklist, Geo: geo,