Refactor: make whitelist validation a bit more robust (#4757) * refactor: extract IP whitelist validation into helper function - Added isIPInWhitelist helper with error handling for individual whitelist entry checks - Replaced inline whitelist matching logic with reusable function calls - Added JSDoc type annotations and error logging for failed IP matching attempts * refactor: simplify whitelist validation with upfront filtering - Moved IP validation to startup time instead of per-request checking - Extracted validateWhitelist function to filter invalid entries once at initialization - Simplified isIPInWhitelist by removing redundant error handling after validation * fix: correct IP whitelist matching to use parsed CIDR notation

bc06f3e3e0ec399d9ffcb4d802faf914a8a0e482

Wolfsblvt <wolfsblvt@gmail.com>

Signed

src/middleware/whitelist.js+35 -2 Viewed

+}
 /**
 + * Validates and filters the whitelist, removing any invalid entries.
 + * @param {string[]} entries - The whitelist entries to validate
 + * @returns {string[]} The filtered list of valid whitelist entries
 + */
 +function validateWhitelist(entries) {
 +    const validEntries = [];
++
 +    for (const entry of entries) {
 +        try {
 +            // This will throw if the entry is not a valid IP or CIDR
 +            ipMatching.getMatch(entry);
 +            validEntries.push(entry);
 +        } catch (e) {
 +            console.warn(`Whitelist ${color.red('Warning')}: Ignoring invalid entry ${color.yellow(entry)} - ${e.message}`);
 +        }
 +    }
++
 +    return validEntries;
 +}
++
 +whitelist = validateWhitelist(whitelist);
++
 +/**
  * Get the client IP address from the request headers.
  * @param {import('express').Request} req Express request object
  * @returns {string|undefined} The client IP address

         const forwardedIp = getForwardedIp(req);
         const userAgent = req.headers['user-agent'];
 +        /**
 +         * Checks if an IP address matches any entry in the whitelist.
 +         * @param {string[]} whitelist - The list of whitelisted IPs/CIDRs
 +         * @param {string} ip - The IP address to check
 +         * @returns {boolean} True if the IP matches any whitelist entry
 +         */
 +        function isIPInWhitelist(whitelist, ip) {
 +            return whitelist.some(x => ipMatching.matches(ip, ipMatching.getMatch(x)));
 +        }
++
         //clientIp = req.connection.remoteAddress.split(':').pop();
 -        if (!whitelist.some(x => ipMatching.matches(clientIp, ipMatching.getMatch(x)))
 +        if (!isIPInWhitelist(whitelist, clientIp)
             || forwardedIp && !whitelist.some(x => ipMatching.matchesisIPInWhitelist(forwardedIpwhitelist, ipMatching.getMatch(x))forwardedIp)
         ) {
             // Log the connection attempt with real IP address
             const ipDetails = forwardedIp