Avoid running the IPv6 regex on IPv4:port in normalizeIp

normalizeIp() called the version-less IPValidator.isIP(ip) first, which runs
the expensive IPv6 regex on every value that is not a bare IPv4 — including
IPv4:port forms that proxies routinely send in X-Forwarded-For / the peer
address. Since this runs in the per-request context constructor, it added
CPU on proxied traffic (introduced in #307).

Reorder normalizeIp to do the cheap structural checks first: bracketed IPv6
([ipv6] / [ipv6]:port, with a strict suffix check), then single-colon
IPv4:port via isIP(host, "4"), and only then the version-less isIP fallback.

Behavior is unchanged (existing ProxyForwardedParserTest suite passes; added
cases for multi-colon IPv4, IPv4:port short-circuit, bracketed IPv4 and
malformed "[::1]foo"). Verified with a JFR A/B on zen-demo-java under ip:port
traffic: total agent CPU 4.90% -> 4.41% (baseline before the regression 4.53%).

Author: dmitrii

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/ProxyForwardedParser.java

@@ -55,35 +55,32 @@ private static String normalizeIp(String ip) {
 
         ip = ip.trim();
 
-        if (IPValidator.isIP(ip)) {
-            return ip;
-        }
-
-        if (ip.startsWith("[") && ip.endsWith("]")) {
-            String unwrappedIp = ip.substring(1, ip.length() - 1);
-            if (IPValidator.isIP(unwrappedIp)) {
-                return unwrappedIp;
-            }
-        }
-
         if (ip.startsWith("[")) {
-            int closingBracket = ip.indexOf("]:");
-            if (closingBracket > 0) {
+            int closingBracket = ip.indexOf(']');
+            boolean validSuffix = closingBracket > 0
+                    && (closingBracket == ip.length() - 1 || ip.startsWith(":", closingBracket + 1));
+            if (validSuffix) {
                 String unwrappedIp = ip.substring(1, closingBracket);
                 if (IPValidator.isIP(unwrappedIp)) {
                     return unwrappedIp;
                 }
             }
+            return null;
         }
 
-        // Some proxies pass along port numbers with IP addresses :
-        if (ip.contains(":")) {
-            String[] ipParts = ip.split(":");
-            if (ipParts.length == 2 && IPValidator.isIP(ipParts[0], "4")) {
-                return ipParts[0];
+        // Handle IPv4:port before the version-less isIP so it skips the IPv6 regex.
+        int firstColon = ip.indexOf(':');
+        if (firstColon > 0 && ip.indexOf(':', firstColon + 1) < 0) {
+            String host = ip.substring(0, firstColon);
+            if (IPValidator.isIP(host, "4")) {
+                return host;
             }
         }
 
+        if (IPValidator.isIP(ip)) {
+            return ip;
+        }
+
         return null;
     }
 

agent_api/src/test/java/helpers/ProxyForwardedParserTest.java

@@ -214,4 +214,30 @@ void testGetIpFromRequest_RawIpWithEmptyStringFallsBackToRawIp() {
         String result = getIpFromRequest("", new HashMap<>());
         assertEquals("", result);
     }
+
+    @Test
+    void testGetIpFromRequest_IPv4WithMultiplePortColonsFallsBackToRawIp() {
+        headers.put("X-Forwarded-For", List.of("1.2.3.4:80:90"));
+        String result = getIpFromRequest("10.0.0.1", headers);
+        assertEquals("10.0.0.1", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_IPv4PortResolvesWithoutTouchingLaterEntries() {
+        headers.put("X-Forwarded-For", List.of("203.0.113.7:54321, 8.8.8.8"));
+        String result = getIpFromRequest("10.0.0.1", headers);
+        assertEquals("203.0.113.7", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_BracketedIPv4Resolves() {
+        String result = getIpFromRequest("[1.2.3.4]", new HashMap<>());
+        assertEquals("1.2.3.4", result);
+    }
+
+    @Test
+    void testGetIpFromRequest_BracketedIpWithTrailingGarbageFallsBackToRawIp() {
+        String result = getIpFromRequest("[::1]foo", new HashMap<>());
+        assertEquals("[::1]foo", result);
+    }
 }