Copilot commented on code in PR #12551: URL: https://github.com/apache/apisix/pull/12551#discussion_r2314725485
########## apisix/init.lua: ########## @@ -599,6 +587,53 @@ function _M.handle_upstream(api_ctx, route, enable_websocket) end +local function handle_x_forwarded_headers(api_ctx) + local addr_is_trusted = trusted_addresses_util.is_trusted(api_ctx.var.realip_remote_addr) + + if not addr_is_trusted then + -- store the original x-forwarded-* headers for later process + api_ctx.var.original_x_forwarded_proto = api_ctx.var.http_x_forwarded_proto + api_ctx.var.original_x_forwarded_host = api_ctx.var.http_x_forwarded_host + api_ctx.var.original_x_forwarded_port = api_ctx.var.http_x_forwarded_port + api_ctx.var.original_x_forwarded_for = api_ctx.var.http_x_forwarded_for + + local proto = api_ctx.var.scheme + local host = api_ctx.var.host + local port = api_ctx.var.server_port + + api_ctx.var.http_x_forwarded_proto = proto + api_ctx.var.http_x_forwarded_host = host + api_ctx.var.http_x_forwarded_port = port + api_ctx.var.http_x_forwarded_for = nil + + -- override the x-forwarded-* headers to the trusted ones + core.request.set_header(api_ctx, "X-Forwarded-Proto", proto) + core.request.set_header(api_ctx, "X-Forwarded-Host", host) + core.request.set_header(api_ctx, "X-Forwarded-Port", port) + -- later processed in ngx_tpl by `$proxy_add_x_forwarded_for` + core.request.set_header(api_ctx, "X-Forwarded-For", nil) + end +end Review Comment: The original X-Forwarded headers are stored but never used. Consider removing the storage of original headers (lines 595-598) unless they are needed elsewhere in the codebase, as this creates unnecessary variable assignments. ########## apisix/utils/trusted-addresses.lua: ########## @@ -0,0 +1,79 @@ +-- +-- Licensed to the Apache Software Foundation (ASF) under one or more +-- contributor license agreements. See the NOTICE file distributed with +-- this work for additional information regarding copyright ownership. +-- The ASF licenses this file to You under the Apache License, Version 2.0 +-- (the "License"); you may not use this file except in compliance with +-- the License. You may obtain a copy of the License at +-- +-- http://www.apache.org/licenses/LICENSE-2.0 +-- +-- Unless required by applicable law or agreed to in writing, software +-- distributed under the License is distributed on an "AS IS" BASIS, +-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +-- See the License for the specific language governing permissions and +-- limitations under the License. +-- +local require = require +local core = require("apisix.core") +local next = next +local ipairs = ipairs + +local trusted_addresses_matcher + +local _M = {} + + +local function validate_trusted_addresses(trusted_addresses) + for _, cidr in ipairs(trusted_addresses) do + if not core.ip.validate_cidr_or_ip(cidr) then + core.log.error("Invalid IP/CIDR '", cidr, "' exists in trusted_addresses") + return false + end + end + return true +end + + +function _M.init_worker() + local local_conf = core.config.local_conf() + local trusted_addresses = core.table.try_read_attr(local_conf, "apisix", "trusted_addresses") + + if not trusted_addresses then + return + end + + if not core.table.isarray(trusted_addresses) then + core.log.error("trusted_addresses '", trusted_addresses, + "' is not an array, please check your configuration") + return + end + + if not next(trusted_addresses) then + core.log.info("trusted_addresses is an empty array") + return + end + + if not validate_trusted_addresses(trusted_addresses) then + return + end + + local matcher, err = core.ip.create_ip_matcher(trusted_addresses) + if not matcher then + core.log.error("failed to create ip matcher for trusted_addresses: ", err) + return + end + + trusted_addresses_matcher = matcher +end + + +function _M.is_trusted(address) + if not trusted_addresses_matcher then + core.log.info("trusted_addresses_matcher is not initialized") + return false + end + return trusted_addresses_matcher:match(address) +end Review Comment: The info log message is generated on every call when trusted_addresses_matcher is not initialized. This could create excessive logging in high-traffic scenarios. Consider using a one-time warning or debug level logging instead. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
