mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-18 16:46:17 +00:00
Tobias GesellchenandClaude Opus 4.8
67c30850cd
chi v5.3.0 deprecates middleware.RealIP (IP-spoofing advisories), which failed the Lint and Static Security Analysis CI jobs (SA1019). Replace the RealIP wrapper with chi's middleware.ClientIP: ClientIPFromRemoteAddr is always applied so middleware.GetClientIP is populated, and when trust_forwarded_headers is set and the immediate peer is a trusted-proxy CIDR, ClientIPFromXFF resolves the real client from X-Forwarded-For (rightmost entry outside the trusted CIDRs). The immediate-peer trust gate is preserved, so a non-trusted peer's XFF is ignored. CIDR strings are validated with netip.ParsePrefix first to avoid ClientIPFromXFF's panic. Behavior change: only X-Forwarded-For is honored now (RealIP also read X-Real-IP / True-Client-IP). Docs and a release note follow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>