chore(core-api): get client IP from x-forwarded-for header (#4527)

* chore(core-api): get ip from x-forwarded-for header * chore(core-api): pass trustProxy option to plugins * chore(core-api): resolve ip method * chore(core-api): resolve ip in plugins * test(core-api): getIp
ArkEcosystem · Sep 30, 2021 · f85b927 · f85b927
1 parent 58789ed
commit f85b927
Show file tree

Hide file tree

Showing 6 changed files with 69 additions and 7 deletions.
diff --git a/__tests__/unit/core-api/utils/get-ip.test.ts b/__tests__/unit/core-api/utils/get-ip.test.ts
@@ -0,0 +1,34 @@
+import { getIp } from "@packages/core-api/src/utils/get-ip";
+
+const clientIp = "127.0.0.1";
+const proxyIp = "127.0.0.2";
+
+const request = {
+    info: {
+        remoteAddress: proxyIp,
+    },
+    headers: {
+        ["x-forwarded-for"]: clientIp,
+    },
+};
+
+describe("getIp", () => {
+    it("should return IP from remoteAddress if trustProxy = false", () => {
+        expect(getIp(request, false)).toEqual(proxyIp);
+    });
+
+    it("should return IP from headers if trustProxy = true", () => {
+        expect(getIp(request, true)).toEqual(clientIp);
+    });
+
+    it("should return IP remoteAddress if trustProxy = true and x-forwarded-for headers are not set", () => {
+        const requestWithoutHeaders = {
+            info: {
+                remoteAddress: clientIp,
+            },
+            headers: {},
+        };
+
+        expect(getIp(requestWithoutHeaders, true)).toEqual(clientIp);
+    });
+});
diff --git a/packages/core-api/src/plugins/index.ts b/packages/core-api/src/plugins/index.ts
@@ -1,14 +1,15 @@
-import { dotSeparatedQuery } from "./dot-separated-query";
 import { commaArrayQuery } from "./comma-array-query";
+import { dotSeparatedQuery } from "./dot-separated-query";
 import { hapiAjv } from "./hapi-ajv";
-import { whitelist } from "./whitelist";
 import { responseHeaders } from "./response-headers";
+import { whitelist } from "./whitelist";
 
 export const preparePlugins = (config) => [
     {
         plugin: whitelist,
         options: {
             whitelist: config.whitelist,
+            trustProxy: config.trustProxy,
         },
     },
     { plugin: hapiAjv },
@@ -20,7 +21,10 @@ export const preparePlugins = (config) => [
     },
     {
         plugin: require("./rate-limit"),
-        options: config.rateLimit,
+        options: {
+            ...config.rateLimit,
+            trustProxy: config.trustProxy,
+        },
     },
     {
         plugin: require("./pagination"),

diff --git a/packages/core-api/src/plugins/rate-limit.ts b/packages/core-api/src/plugins/rate-limit.ts
@@ -1,7 +1,9 @@
 import Boom from "@hapi/boom";
 import Hapi from "@hapi/hapi";
 import mm from "nanomatch";
-import { RateLimiterMemory, RLWrapperBlackAndWhite, RateLimiterRes } from "rate-limiter-flexible";
+import { RateLimiterMemory, RateLimiterRes, RLWrapperBlackAndWhite } from "rate-limiter-flexible";
+
+import { getIp } from "../utils";
 
 type RateLimitPluginData = {
     remaining: number;
@@ -28,7 +30,14 @@ export = {
     once: true,
     async register(
         server: Hapi.Server,
-        options: { enabled: boolean; points: number; duration: number; whitelist: string[]; blacklist: string[] },
+        options: {
+            enabled: boolean;
+            points: number;
+            duration: number;
+            whitelist: string[];
+            blacklist: string[];
+            trustProxy: boolean;
+        },
     ): Promise<void> {
         if (options.enabled === false) {
             return;
@@ -51,7 +60,10 @@ export = {
             type: "onPostAuth",
             async method(request, h) {
                 try {
-                    const rateLimitRes: RateLimiterRes = await rateLimiter.consume(request.info.remoteAddress, 1);
+                    const rateLimitRes: RateLimiterRes = await rateLimiter.consume(
+                        getIp(request, options.trustProxy),
+                        1,
+                    );
 
                     request.plugins["rate-limit"] = {
                         remaining: rateLimitRes.remainingPoints,

diff --git a/packages/core-api/src/plugins/whitelist.ts b/packages/core-api/src/plugins/whitelist.ts
@@ -1,6 +1,8 @@
 import { Utils } from "@arkecosystem/core-kernel";
 import Boom from "@hapi/boom";
 
+import { getIp } from "../utils";
+
 export const whitelist = {
     name: "whitelist",
     version: "0.1.0",
@@ -12,7 +14,7 @@ export const whitelist = {
                     return h.continue;
                 }
 
-                if (Utils.isWhitelisted(options.whitelist, request.info.remoteAddress)) {
+                if (Utils.isWhitelisted(options.whitelist, getIp(request, options.trustProxy))) {
                     return h.continue;
                 }
 

diff --git a/packages/core-api/src/utils/get-ip.ts b/packages/core-api/src/utils/get-ip.ts
@@ -0,0 +1,9 @@
+import { Request } from "@hapi/hapi";
+
+export const getIp = (request: Request, trustProxy: boolean): string => {
+    if (trustProxy) {
+        return request.headers["x-forwarded-for"]?.split(",")[0]?.trim() ?? request.info.remoteAddress;
+    }
+
+    return request.info.remoteAddress;
+};
diff --git a/packages/core-api/src/utils/index.ts b/packages/core-api/src/utils/index.ts
@@ -0,0 +1 @@
+export * from "./get-ip"