rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix review comments on cookie banner API

Browse Source 
Parse only the first IP from X-Forwarded-For to prevent
the full chain from bypassing anonymization. Add secondary
sort key for deterministic consent selection. Reject origins
with empty port suffix in the validator.

Signed-off-by: Émile Ré <emile@getprobo.com>
This commit is contained in:
Émile Ré
2026-04-14 15:44:48 +04:00
parent 30a86a91f1
commit 8ec434d67e
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/coredata/cookie_consent_record.go
View File

@@ -223,7 +223,7 @@ WHERE
%s %s
AND cookie_banner_id = @cookie_banner_id AND cookie_banner_id = @cookie_banner_id
AND visitor_id = @visitor_id AND visitor_id = @visitor_id
ORDER BY created_at DESC ORDER BY created_at DESC, id DESC
LIMIT 1; LIMIT 1;
` `

8
pkg/server/api/cookiebanner/v1/handler.go
View File

@@ -19,6 +19,7 @@ import (
"errors" "errors"
"net" "net"
"net/http" "net/http"
"strings"
"github.com/go-chi/chi/v5" "github.com/go-chi/chi/v5"
"go.gearno.de/kit/httpserver" "go.gearno.de/kit/httpserver"
@@ -164,6 +165,13 @@ func (h *Handler) handlePostConsent(w http.ResponseWriter, r *http.Request) {
func clientIP(r *http.Request) string { func clientIP(r *http.Request) string {
if xff := r.Header.Get("X-Forwarded-For"); xff != "" { if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
// X-Forwarded-For may contain a comma-separated chain; use only the
// leftmost (client) entry.
if i := strings.IndexByte(xff, ','); i != -1 {
xff = xff[:i]
}
xff = strings.TrimSpace(xff)
if ip, _, err := net.SplitHostPort(xff); err == nil { if ip, _, err := net.SplitHostPort(xff); err == nil {
return ip return ip
} }

2
pkg/validator/validator_format.go
View File

@@ -160,7 +160,7 @@ func Origin() ValidatorFunc {
return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)") return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
} }
if parsedURL.Host == "" { if parsedURL.Host == "" || parsedURL.Hostname() == "" {
return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)") return newValidationError(ErrorCodeInvalidFormat, "must be a valid origin (e.g. https://example.com)")
} }