arturobernalg opened a new pull request, #1166: URL: https://github.com/apache/tomcat/pull/1166
https://bz.apache.org/bugzilla/show_bug.cgi?id=70315 `NetMaskSet.contains(String)` passed its input to `InetAddress.getByName()`. An `X-Forwarded-For` entry that is not an IP address, such as `unknown` or a host name, caused a blocking DNS lookup on the request processing thread in `RemoteIpValve` and `RemoteIpFilter`, and a host name such as `localhost` could be matched as an internal or trusted proxy. Only IPv4 and IPv6 literals are accepted now, parsed without any name resolution. Other values do not match, as with the regular expression configuration. The new tests fail without the change and pass with it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
