mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-26 13:40:26 +00:00
Anso
b833e554b4
The host console WebSocket handler took the audit row's client IP from the first X-Forwarded-For hop ahead of the socket address, without checking that the peer was a trusted reverse proxy. Express's `trust proxy` setting does not apply on an upgrade, so the header was taken at face value and any principal able to open a host shell could write an arbitrary IP into the host-console audit trail. CWE-348, audit-log integrity only: the address is not used for an access decision in that handler. Client-IP resolution on the upgrade path now goes through a single helper that applies the same trusted-proxy predicate as the HTTP path and mirrors proxy-addr: a forwarded hop counts only when the direct peer matches SENCHO_TRUSTED_PROXY_CIDRS, and the recorded address is the leftmost hop that no trusted proxy supplied. Unset, malformed, or duplicate proxy configuration fails closed to the socket address, as it already does for `req.ip`. The host console audit row still records the real client address behind a properly configured reverse proxy, and now matches what the HTTP audit path records for the same request. A remote node records the forwarding instance's address unless that instance is allowlisted, which the configuration reference now states.