Reject trailing content after ']' in bracketed-IPv6 parsing

Addresses review feedback: indexOf(']') accepted malformed values such as
"[::1]foo" (returning the inner IP) because it ignored anything after the
bracket. Require the char after ']' to be end-of-string or ':' (a port),
matching the pre-existing strictness ("[ipv6]" or "[ipv6]:port" only).

Author: dmitrii

agent_api/src/main/java/dev/aikido/agent_api/helpers/net/ProxyForwardedParser.java

@@ -59,7 +59,11 @@ private static String normalizeIp(String ip) {
         // Handle first so we never run the (expensive) full isIP on the bracketed form.
         if (ip.startsWith("[")) {
             int closingBracket = ip.indexOf(']');
-            if (closingBracket > 0) {
+            // Only accept "[ipv6]" (bracket at the end) or "[ipv6]:port" (':' right
+            // after the bracket) — reject any other trailing content, e.g. "[::1]foo".
+            boolean validSuffix = closingBracket > 0
+                    && (closingBracket == ip.length() - 1 || ip.startsWith(":", closingBracket + 1));
+            if (validSuffix) {
                 String unwrappedIp = ip.substring(1, closingBracket);
                 if (IPValidator.isIP(unwrappedIp)) {
                     return unwrappedIp;

agent_api/src/test/java/helpers/ProxyForwardedParserTest.java

@@ -236,4 +236,11 @@ void testGetIpFromRequest_BracketedIPv4Resolves() {
         String result = getIpFromRequest("[1.2.3.4]", new HashMap<>());
         assertEquals("1.2.3.4", result);
     }
+
+    @Test
+    void testGetIpFromRequest_BracketedIpWithTrailingGarbageFallsBackToRawIp() {
+        // "[::1]foo" is malformed (trailing content after ']') and must not resolve.
+        String result = getIpFromRequest("[::1]foo", new HashMap<>());
+        assertEquals("[::1]foo", result);
+    }
 }