Back to all reviewers

Safe proxy configuration

mastodon/mastodon
Based on 2 comments
JavaScript

When configuring proxy settings for network applications, always use proper compilation methods to prevent runtime errors and ensure consistent IP address handling across different connection types. Improper proxy configuration can cause server crashes when IP addresses are accessed, particularly when using string-based configurations with multiple values.

Networking JavaScript

Reviewer Prompt

When configuring proxy settings for network applications, always use proper compilation methods to prevent runtime errors and ensure consistent IP address handling across different connection types. Improper proxy configuration can cause server crashes when IP addresses are accessed, particularly when using string-based configurations with multiple values.

Use proxyaddr.compile() to safely process proxy configurations and define IP properties consistently:

const trustProxy = proxyaddr.compile(
  process.env.TRUSTED_PROXY_IP ?
    process.env.TRUSTED_PROXY_IP.split(/(?:\s*,\s*|\s+)/) :
    ['loopback', 'uniquelocal']
);

// For websocket connections, define IP property to match Express behavior
Object.defineProperty(request, 'ip', {
  configurable: true,
  enumerable: true,
  get() {
    return proxyaddr(this, trustProxy);
  }
});

This approach prevents server crashes from malformed proxy configurations and ensures that IP address access works uniformly across HTTP and WebSocket connections, enabling consistent network security features like IP blocking.

2
Comments Analyzed
JavaScript
Primary Language
Networking
Category

Source Discussions