Cap the X-Forwarded-For hop walk at 64 entries (closes #124)

The walk now keeps only the rightmost 64 hops, so an attacker-supplied chain cannot burn unbounded CPU in the rate-limit key function. Running off the end of the truncated slice falls back to the peer address, the same fail-closed direction the rest of the function takes. Also corrects the unparseable-RemoteAddr comment, which overclaimed about Unix-socket peers.

internal/middleware/ratelimit_test.go

@@ -8,7 +8,9 @@ import (
 	"net/http/httptest"
 	"net/netip"
 	"os"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"sneak.berlin/go/webhooker/internal/config"
@@ -568,6 +570,45 @@ func TestRateLimitKey_ChainWalkSkipsClientPrepended(t *testing.T) {
 	)
 }
 
+// TestRateLimitKey_LongChainCapsWalkAndFallsBackToPeer covers the
+// hop-walk cap. A client behind the trusted proxy can pad
+// X-Forwarded-For with tens of thousands of trusted-looking hops,
+// which costs a walk proportional to the padding and, once the walk
+// runs off the left end of the chain, reaches the entry the client
+// put there. Capping the walk stops both: the key falls back to the
+// peer address, so rotating the head of the chain mints no bucket,
+// and the run does not scale with the chain length.
+func TestRateLimitKey_LongChainCapsWalkAndFallsBackToPeer(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	// 50k hops is roughly 0.9 MB, within the default
+	// MaxHeaderBytes.
+	const hops = 50000
+
+	padding := strings.Repeat(", 10.0.0.2", hops-1)
+
+	start := time.Now()
+
+	assertSharedBucket(
+		t, trustedProxies("10.0.0.0/8"), "10.0.0.1:44444",
+		func(i int) map[string]string {
+			return map[string]string{
+				headerXFF: fmt.Sprintf("9.9.9.%d%s", i+1, padding),
+			}
+		},
+		"a padded X-Forwarded-For chain must fall back to the "+
+			"peer address, not reach the client-controlled entry "+
+			"at the head of the chain",
+	)
+
+	assert.Less(
+		t, time.Since(start), 2*time.Second,
+		"the capped walk must not scale with the chain length",
+	)
+}
+
 // TestReceiverRateLimit_IgnoresForwardedFromUntrustedPeer proves
 // the receiver limiter uses the same gated key function as the
 // POST limiters.