0854f94089
- Added a reset of the models.Setting struct before querying for settings in both the Manager and Cerberus components to avoid ID leakage from previous queries. - Introduced new functions in Cerberus for checking admin authentication and admin whitelist status. - Enhanced middleware logic to allow admin users to bypass ACL checks if their IP is whitelisted. - Added tests to verify the behavior of the middleware with respect to ACLs and admin whitelisting. - Created a new utility for checking if an IP is in a CIDR list. - Updated various services to use `Where` clause for fetching records by ID instead of directly passing the ID to `First`, ensuring consistency in query patterns. - Added comprehensive tests for settings queries to demonstrate and verify the fix for ID leakage issues.
48 lines
864 B
Go
48 lines
864 B
Go
package security
|
|
|
|
import (
|
|
"net"
|
|
"strings"
|
|
|
|
"github.com/Wikid82/charon/backend/internal/util"
|
|
)
|
|
|
|
// IsIPInCIDRList returns true if clientIP matches any CIDR or IP in the list.
|
|
// The list is a comma-separated string of CIDRs and/or IPs.
|
|
func IsIPInCIDRList(clientIP, cidrList string) bool {
|
|
if strings.TrimSpace(cidrList) == "" {
|
|
return false
|
|
}
|
|
|
|
canonical := util.CanonicalizeIPForSecurity(clientIP)
|
|
ip := net.ParseIP(canonical)
|
|
if ip == nil {
|
|
return false
|
|
}
|
|
|
|
parts := strings.Split(cidrList, ",")
|
|
for _, part := range parts {
|
|
entry := strings.TrimSpace(part)
|
|
if entry == "" {
|
|
continue
|
|
}
|
|
|
|
if parsed := net.ParseIP(entry); parsed != nil {
|
|
if ip.Equal(parsed) {
|
|
return true
|
|
}
|
|
continue
|
|
}
|
|
|
|
_, cidr, err := net.ParseCIDR(entry)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
if cidr.Contains(ip) {
|
|
return true
|
|
}
|
|
}
|
|
|
|
return false
|
|
}
|