Where: internal/config/config.go, parseCIDRList (reading trusted_proxies), and internal/clientip/clientip.go, isTrusted, on next at faad959. Found while building #302.
What is wrong: the same defect as #301, in trusted_proxies. An entry written in the IPv4-mapped form, such as ::ffff:10.0.0.0/104, is accepted, but isTrusted reads every mapped address as the IPv4 address it holds before matching, so the entry never matches anything.
How it fails: an operator lists a proxy's IPv4 range in the mapped form; pixa starts without a word, never trusts that proxy, and takes the proxy's own address as every client's address.
Severity: low (it fails closed: no client can spoof an address through it, but the setting silently does nothing).
Definition of done:
A trusted_proxies entry in the IPv4-mapped form with a prefix of 96 bits or more is read as the IPv4 range it covers, and one under 96 bits stops startup with an error naming the setting, exactly as #302 does for blocked_networks, sharing its code rather than repeating it. README.md says so where it describes trusted_proxies.
Test first; make check green.
Package: internal/config. Starts after #302 lands, which changes the same code.
Model: opus-5-5
Where: `internal/config/config.go`, `parseCIDRList` (reading `trusted_proxies`), and `internal/clientip/clientip.go`, `isTrusted`, on `next` at `faad959`. Found while building https://git.eeqj.de/sneak/pixa/pulls/302.
What is wrong: the same defect as https://git.eeqj.de/sneak/pixa/issues/301, in `trusted_proxies`. An entry written in the IPv4-mapped form, such as `::ffff:10.0.0.0/104`, is accepted, but `isTrusted` reads every mapped address as the IPv4 address it holds before matching, so the entry never matches anything.
How it fails: an operator lists a proxy's IPv4 range in the mapped form; pixa starts without a word, never trusts that proxy, and takes the proxy's own address as every client's address.
Severity: low (it fails closed: no client can spoof an address through it, but the setting silently does nothing).
Definition of done:
1. A `trusted_proxies` entry in the IPv4-mapped form with a prefix of 96 bits or more is read as the IPv4 range it covers, and one under 96 bits stops startup with an error naming the setting, exactly as https://git.eeqj.de/sneak/pixa/pulls/302 does for `blocked_networks`, sharing its code rather than repeating it. `README.md` says so where it describes `trusted_proxies`.
2. Test first; `make check` green.
Package: `internal/config`. Starts after https://git.eeqj.de/sneak/pixa/pulls/302 lands, which changes the same code.
Model: opus-5-5
clawbot
self-assigned this 2026-10-19 01:28:55 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
internal/config/config.go,parseCIDRList(readingtrusted_proxies), andinternal/clientip/clientip.go,isTrusted, onnextatfaad959. Found while building #302.What is wrong: the same defect as #301, in
trusted_proxies. An entry written in the IPv4-mapped form, such as::ffff:10.0.0.0/104, is accepted, butisTrustedreads every mapped address as the IPv4 address it holds before matching, so the entry never matches anything.How it fails: an operator lists a proxy's IPv4 range in the mapped form; pixa starts without a word, never trusts that proxy, and takes the proxy's own address as every client's address.
Severity: low (it fails closed: no client can spoof an address through it, but the setting silently does nothing).
Definition of done:
trusted_proxiesentry in the IPv4-mapped form with a prefix of 96 bits or more is read as the IPv4 range it covers, and one under 96 bits stops startup with an error naming the setting, exactly as #302 does forblocked_networks, sharing its code rather than repeating it.README.mdsays so where it describestrusted_proxies.make checkgreen.Package:
internal/config. Starts after #302 lands, which changes the same code.Model: opus-5-5