From 8ec434d67e09aa51d40c551c39955ad57fb4f6ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= Date: Tue, 14 Apr 2026 15:44:48 +0400 Subject: [PATCH] Fix review comments on cookie banner API MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Parse only the first IP from X-Forwarded-For to prevent the full chain from bypassing anonymization. Add secondary sort key for deterministic consent selection. Reject origins with empty port suffix in the validator. Signed-off-by: Émile Ré --- pkg/coredata/cookie_consent_record.go | 2 +- pkg/server/api/cookiebanner/v1/handler.go | 8 ++++++++ pkg/validator/validator_format.go | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/pkg/coredata/cookie_consent_record.go b/pkg/coredata/cookie_consent_record.go index 6b7fa8827..3a59bd485 100644 --- a/pkg/coredata/cookie_consent_record.go +++ b/pkg/coredata/cookie_consent_record.go @@ -223,7 +223,7 @@ WHERE %s AND cookie_banner_id = @cookie_banner_id AND visitor_id = @visitor_id -ORDER BY created_at DESC +ORDER BY created_at DESC, id DESC LIMIT 1; ` diff --git a/pkg/server/api/cookiebanner/v1/handler.go b/pkg/server/api/cookiebanner/v1/handler.go index b154a4454..883eb2aec 100644 --- a/pkg/server/api/cookiebanner/v1/handler.go +++ b/pkg/server/api/cookiebanner/v1/handler.go @@ -19,6 +19,7 @@ import ( "errors" "net" "net/http" + "strings" "github.com/go-chi/chi/v5" "go.gearno.de/kit/httpserver" @@ -164,6 +165,13 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) { func clientIP(r *http.Request) string { if xff := r.Header.Get("X-Forwarded-For"); xff != "" { + // X-Forwarded-For may contain a comma-separated chain; use only the + // leftmost (client) entry. + if i := strings.IndexByte(xff, ','); i != -1 { + xff = xff[:i] + } + xff = strings.TrimSpace(xff) + if ip, _, err := net.SplitHostPort(xff); err == nil { return ip } diff --git a/pkg/validator/validator_format.go b/pkg/validator/validator_format.go index 394ba7262..af3d51aa1 100644 --- a/pkg/validator/validator_format.go +++ b/pkg/validator/validator_format.go @@ -160,7 +160,7 @@ func Origin() ValidatorFunc { return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)") } - if parsedURL.Host == "" { + if parsedURL.Host == "" || parsedURL.Hostname() == "" { return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)") }