Merge pull request #319 from AikidoSec/fix/proxy-forwarded-ipv6-regex-perf

Avoid IPv6 regex on IPv4:port in ProxyForwardedParser.normalizeIp

Author: hansott

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/ProxyForwardedParser.java

@@ -55,8 +55,12 @@ private static String normalizeIp(String ip) {
 
         ip = ip.trim();
 
-        if (IPValidator.isIP(ip)) {
-            return ip;
+        // Some proxies pass along port numbers with IPv4 addresses: ip:port
+        if (ip.contains(":")) {
+            String[] ipParts = ip.split(":");
+            if (ipParts.length == 2 && IPValidator.isIP(ipParts[0], "4")) {
+                return ipParts[0];
+            }
         }
 
         if (ip.startsWith("[") && ip.endsWith("]")) {
@@ -76,12 +80,8 @@ private static String normalizeIp(String ip) {
             }
         }
 
-        // Some proxies pass along port numbers with IP addresses :
-        if (ip.contains(":")) {
-            String[] ipParts = ip.split(":");
-            if (ipParts.length == 2 && IPValidator.isIP(ipParts[0], "4")) {
-                return ipParts[0];
-            }
+        if (IPValidator.isIP(ip)) {
+            return ip;
         }
 
         return null;

agent_api/src/test/java/helpers/ProxyForwardedParserTest.java

@@ -214,4 +214,30 @@ void testGetIpFromRequest_RawIpWithEmptyStringFallsBackToRawIp() {
         String result = getIpFromRequest("", new HashMap<>());
         assertEquals("", result);
     }
+
+    @Test
+    void testGetIpFromRequest_IPv4WithMultiplePortColonsFallsBackToRawIp() {
+        headers.put("X-Forwarded-For", List.of("1.2.3.4:80:90"));
+        String result = getIpFromRequest("10.0.0.1", headers);
+        assertEquals("10.0.0.1", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_IPv4PortResolvesWithoutTouchingLaterEntries() {
+        headers.put("X-Forwarded-For", List.of("203.0.113.7:54321, 8.8.8.8"));
+        String result = getIpFromRequest("10.0.0.1", headers);
+        assertEquals("203.0.113.7", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_BracketedIPv4Resolves() {
+        String result = getIpFromRequest("[1.2.3.4]", new HashMap<>());
+        assertEquals("1.2.3.4", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_BracketedIpWithTrailingGarbageFallsBackToRawIp() {
+        String result = getIpFromRequest("[::1]foo", new HashMap<>());
+        assertEquals("[::1]foo", result);
+    }
 }