tcjlj/flvx
1
0
Fork 0
mirror of https://github.com/Sagit-chu/flvx.git synced 2026-09-28 07:36:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(backend): allow setting reserved ip addresses as target

Browse Source 
Only forbid internal networks (loopback and private ips), removing restrictions on reserved addresses like multicast or unspecified.
This commit is contained in:
sagitchu
2026-04-22 19:00:21 +08:00
parent eecdd62d3a
commit a070d0f4d3
3 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go-backend/internal/http/handler/federation.go
+1 -1
View File
@@ -650,7 +650,7 @@ func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
return return
} }
if err := IsSafeRemoteAddr(rURL.Host); err != nil { if err := IsSafeRemoteAddr(rURL.Host); err != nil {
response.WriteJSON(w, response.Err(403, "禁止将远程节点地址设置为内部网络或保留地址")) response.WriteJSON(w, response.Err(403, "禁止将远程节点地址设置为内部网络"))
return return
} }
go-backend/internal/http/handler/mutations.go
+2 -2
View File
@@ -1726,7 +1726,7 @@ func (h *Handler) forwardCreate(w http.ResponseWriter, r *http.Request) {
} }
if roleID != 0 { if roleID != 0 {
if err := IsSafeRemoteAddr(remoteAddr); err != nil { if err := IsSafeRemoteAddr(remoteAddr); err != nil {
response.WriteJSON(w, response.Err(403, "禁止将目标地址设置为内部网络或保留地址")) response.WriteJSON(w, response.Err(403, "禁止将目标地址设置为内部网络"))
return return
} }
if speedIDVal, ok := req["speedId"]; ok && speedIDVal != nil { if speedIDVal, ok := req["speedId"]; ok && speedIDVal != nil {
@@ -1850,7 +1850,7 @@ func (h *Handler) forwardUpdate(w http.ResponseWriter, r *http.Request) {
} }
if actorRole != 0 { if actorRole != 0 {
if err := IsSafeRemoteAddr(remoteAddr); err != nil { if err := IsSafeRemoteAddr(remoteAddr); err != nil {
response.WriteJSON(w, response.Err(403, "禁止将目标地址设置为内部网络或保留地址")) response.WriteJSON(w, response.Err(403, "禁止将目标地址设置为内部网络"))
return return
} }
} }
go-backend/internal/http/handler/security_utils.go
+2 -2
View File
@@ -31,8 +31,8 @@ func IsSafeRemoteAddr(addr string) error {
} }
for _, ip := range ips { for _, ip := range ips {
if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || ip.IsUnspecified() || ip.IsMulticast() { if ip.IsLoopback() || ip.IsPrivate() {
return fmt.Errorf("address resolves to internal or reserved IP: %s", ip.String()) return fmt.Errorf("address resolves to internal IP: %s", ip.String())
} }
} }