Refactor: make whitelist validation a bit more robust (#4757) * refactor: extract IP whitelist validation into helper function - Added isIPInWhitelist helper with error handling for individual whitelist entry checks - Replaced inline whitelist matching logic with reusable function calls - Added JSDoc type annotations and error logging for failed IP matching attempts * refactor: simplify whitelist validation with upfront filtering - Moved IP validation to startup time instead of per-request checking - Extracted validateWhitelist function to filter invalid entries once at initialization - Simplified isIPInWhitelist by removing redundant error handling after validation * fix: correct IP whitelist matching to use parsed CIDR notation

bc06f3e3e0ec399d9ffcb4d802faf914a8a0e482

Wolfsblvt <wolfsblvt@gmail.com>

Signed

src/middleware/whitelist.js+35 -2 Viewed

+}
 /**
+ * Validates and filters the whitelist, removing any invalid entries.
+ * @param {string[]} entries - The whitelist entries to validate
+ * @returns {string[]} The filtered list of valid whitelist entries
+ */
+function validateWhitelist(entries) {
+    const validEntries = [];
+    for (const entry of entries) {
+        try {
+            // This will throw if the entry is not a valid IP or CIDR
+            ipMatching.getMatch(entry);
+            validEntries.push(entry);
+        } catch (e) {
+            console.warn(`Whitelist ${color.red('Warning')}: Ignoring invalid entry ${color.yellow(entry)} - ${e.message}`);
+        }
+    }
+    return validEntries;
+}
+whitelist = validateWhitelist(whitelist);
+/**
  * Get the client IP address from the request headers.
  * @param {import('express').Request} req Express request object
  * @returns {string|undefined} The client IP address

         const forwardedIp = getForwardedIp(req);
         const userAgent = req.headers['user-agent'];
+        /**
+         * Checks if an IP address matches any entry in the whitelist.
+         * @param {string[]} whitelist - The list of whitelisted IPs/CIDRs
+         * @param {string} ip - The IP address to check
+         * @returns {boolean} True if the IP matches any whitelist entry
+         */
+        function isIPInWhitelist(whitelist, ip) {
+            return whitelist.some(x => ipMatching.matches(ip, ipMatching.getMatch(x)));
+        }
         //clientIp = req.connection.remoteAddress.split(':').pop();
-        if (!whitelist.some(x => ipMatching.matches(clientIp, ipMatching.getMatch(x)))
+        if (!isIPInWhitelist(whitelist, clientIp)
-            || forwardedIp && !whitelist.some(x => ipMatching.matches(forwardedIp, ipMatching.getMatch(x)))
+            || forwardedIp && !isIPInWhitelist(whitelist, forwardedIp)
         ) {
             // Log the connection attempt with real IP address
             const ipDetails = forwardedIp