fix: prevent IP spoofing in getClientIp by trusting platform-set request.ip#2573
fix: prevent IP spoofing in getClientIp by trusting platform-set request.ip#2573tmdeveloper007 wants to merge 3 commits into
Conversation
…e TS type errors The retry-after and ratelimit-reset headers returned by Axios have the type string | number | true | string[] | AxiosHeaders. Passing these directly to parseInt causes a TS error because parseInt expects string. Wrapping with String() coerces the value before parsing. Fixes CI Type Check failures across all fork PRs.
…est.ip Issue nisshchayarathi#2412: The rate limiter trusted X-Forwarded-For and X-Real-IP headers unconditionally, allowing attackers to bypass rate limits by spoofing these headers. The fix prefers request.ip (set by the hosting platform from the actual TCP connection) and only trusts X-Forwarded-For when the connection comes from a known trusted proxy (localhost or private IP range). Using request.ip as the primary source, with safe fallback, eliminates the IP spoofing attack vector for all rate-limited endpoints.
|
Someone is attempting to deploy a commit to the Nisshchaya's projects Team on Vercel. A member of the Team first needs to authorize it. |
|
Warning Review limit reached
Next review available in: 38 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🎉 Thanks for your contribution, @tmdeveloper007!Your PR has passed our automated GSSoC quality checks. Here's a quick summary:
A maintainer will review your PR soon. Please be patient and available for feedback. 💪 GSSoC'26 automation · Maintainer: @nisshchayarathi |
🎉 Thanks for your contribution, @tmdeveloper007!Your PR has passed our automated GSSoC quality checks. Here's a quick summary:
A maintainer will review your PR soon. Please be patient and available for feedback. 💪 GSSoC'26 automation · Maintainer: @nisshchayarathi |
- Move completeGraph, filters, expandedNodes declarations before nodeChurnMap useMemo to avoid TypeScript TDZ errors (variable used before declaration) - Import GraphNode and GraphLink from graphAnalyzer to fix type mismatch where local interface conflicted with analyzer return type - Accept string[] instead of Set<string> in getFilteredNodes since useGraphFilters returns arrays not Sets
tmdeveloper007
force-pushed
the
2412-ip-spoofing-fix
branch
from
8d0f8b8 to
2edc7b4
Compare
🎉 Thanks for your contribution, @tmdeveloper007!Your PR has passed our automated GSSoC quality checks. Here's a quick summary:
A maintainer will review your PR soon. Please be patient and available for feedback. 💪 GSSoC'26 automation · Maintainer: @nisshchayarathi |
|
CI green (Type Check, Build, Unit Tests, CodeQL, Lint all passing). Ready to merge. |
|
Hi! CI checks (TypeScript, Lint, CodeQL, etc.) are passing on this PR. The only CI gate showing as failed is the Vercel deployment check ( The code changes are ready for review. Could a maintainer please take a look? Happy to address any feedback. |
1 participant
Summary
Fixes #2412 - IP spoofing vulnerability in the rate limiter.
Problem:
getClientIp()trustedX-Forwarded-ForandX-Real-IPheaders unconditionally. An attacker could bypass rate limits by setting these headers to any arbitrary IP address.Fix: Prefer
request.ip(set by the hosting platform from the actual TCP connection) as the primary source. Only trustX-Forwarded-Forwhen the connection comes from a known trusted proxy (localhost or private IP range). This eliminates the spoofing attack vector for all rate-limited endpoints.Changes:
lib/services/rateLimitService.ts: RefactoredgetClientIp()to use platform-setrequest.ipwith safe XFF fallback only behind trusted proxies. AddedisTrustedProxyIp()helper.Impact: All authentication, AI, and repository endpoints that use rate limiting are protected.