From 83acb7a275480846af14d2ac0325396651826580 Mon Sep 17 00:00:00 2001 From: Joe Mahady Date: Wed, 29 Jul 2026 10:37:36 +0100 Subject: [PATCH 1/3] Implement AI Scan -- MEDIUM -- client-ip-for-rate-limiting-taken-from-spoofable-headers / uaa ai-assisted=yes Co-authored-by: Cursor --- .../core/http/RequestInfoImpl.java | 15 +---------- .../core/http/RequestInfoImplTest.java | 26 ++----------------- 2 files changed, 3 insertions(+), 38 deletions(-) diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java b/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java index bd169536312..34410be4777 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java @@ -38,20 +38,7 @@ public String getAuthorizationHeader() { @Override public String getClientIP() { - String value = header("X-Client-IP"); - if (value == null) { - value = header("X-Real-IP"); - } - if (value == null) { - value = header("X-Forwarded-For"); // Added by the GoRouter - if (value != null) { - int at = value.indexOf(','); - if (at != -1) { - value = StringUtils.stripToNull(value.substring(0, at)); - } - } - } - return value != null ? value : StringUtils.stripToNull(getRemoteAddr()); + return StringUtils.stripToNull(getRemoteAddr()); } public boolean hasHeaderNames() { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java index ad76975ea8a..6171e98adad 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java @@ -38,35 +38,13 @@ void getAuthorizationHeader() { } @Test - void getClientIP_X_Client() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn("Mocked-IP-C "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Mocked-IP-R "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0, Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-C"); - } - - @Test - void getClientIP_X_Real() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Mocked-IP-R "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0 , Mocked-IP-FF1"); + void getClientIP_remoteAddr() { + when(mockHSRequest.getRemoteAddr()).thenReturn("Mocked-IP-R "); RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); assertThat(requestInfo).isNotNull(); assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-R"); } - @Test - void getClientIP_X_Forwarded() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0 , Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-FF0"); - } - @Test void proxyingWorking() { HttpServletRequest mockRequest = mock(HttpServletRequest.class); From 0b9ab39e863b2456eea6bfcc98218c5a71aa1b53 Mon Sep 17 00:00:00 2001 From: Joe Mahady Date: Fri, 7 Aug 2026 12:30:41 +0100 Subject: [PATCH 2/3] Fix client ip for rate limiting --- .../uaa/ratelimiting/core/http/RequestInfoImplTest.java | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java index 05f1456f08d..0d60a7e4749 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java @@ -39,6 +39,9 @@ void getAuthorizationHeader() { @Test void getClientIP_remoteAddr() { + when(mockHSRequest.getHeader("X-Client-IP")).thenReturn("Spoofed-IP-1"); + when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Spoofed-IP-2"); + when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Spoofed-IP-3"); when(mockHSRequest.getRemoteAddr()).thenReturn("Mocked-IP-R "); RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); assertThat(requestInfo).isNotNull(); From 9f71e0f231af9023ba7e4e2fd7b26053cdffcb28 Mon Sep 17 00:00:00 2001 From: Joe Mahady Date: Fri, 7 Aug 2026 14:16:53 +0100 Subject: [PATCH 3/3] Fix client ip for rate limiting --- .../core/http/RequestInfoImplTest.java | 20 ------------------- 1 file changed, 20 deletions(-) diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java index 0d60a7e4749..a3cf4039596 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java @@ -60,26 +60,6 @@ void getClientIP_fallsBackToRemoteAddr_whenSpoofableHeadersAbsent() { assertThat(requestInfo.getClientIP()).isEqualTo("10.0.0.1"); } - @Test - void getClientIP_X_Client() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn("Mocked-IP-C "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Mocked-IP-R "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0, Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-C"); - } - - @Test - void getClientIP_X_Real() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Mocked-IP-R "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0 , Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-R"); - } - @Test void proxyingWorking() { HttpServletRequest mockRequest = mock(HttpServletRequest.class);