test: export + unit-test resolveTrustProxy (#61) #105

New Issue

Ghost · 2026-06-21T05:05:39+03:00

Ghost commented

2026-06-21 05:05:39 +03:00

PR #101 (commit 52159135, closes #61) added resolveTrustProxy() — apps/server/src/main.ts:22 — the fix against X-Forwarded-For spoofing (safe default loopback, linklocal, uniquelocal instead of trust-all).

Gap: untested and not exported, so it cannot be tested as-is. A regression (e.g. parsing false as the string/int fallback, or losing the safe default → true) would silently re-open the XFF spoofing hole the /mcp + share-AI per-IP limiters depend on.

Needed: export resolveTrustProxy (or move to a small helper module) and unit-test each branch: ''/undefined → 'loopback, linklocal, uniquelocal'; 'true' → true; 'false' → false; '2' → 2; '10.0.0.0/8' → passthrough; non-numeric/-1 → passthrough string.

Found in code review of PR #101.

PR #101 (commit 52159135, closes #61) added `resolveTrustProxy()` — apps/server/src/main.ts:22 — the fix against X-Forwarded-For spoofing (safe default `loopback, linklocal, uniquelocal` instead of trust-all). **Gap:** untested **and not exported**, so it cannot be tested as-is. A regression (e.g. parsing `false` as the string/int fallback, or losing the safe default → `true`) would silently re-open the XFF spoofing hole the /mcp + share-AI per-IP limiters depend on. **Needed:** export `resolveTrustProxy` (or move to a small helper module) and unit-test each branch: `''`/undefined → `'loopback, linklocal, uniquelocal'`; `'true'` → true; `'false'` → false; `'2'` → 2; `'10.0.0.0/8'` → passthrough; non-numeric/` -1 ` → passthrough string. _Found in code review of PR #101._

Ghost added the test security labels 2026-06-21 05:05:39 +03:00

vvzvlad referenced this issue from a commit

2026-06-21 05:24:26 +03:00

fix(review): address PR #101 review findings (dead DI, docs)

Ghost referenced this issue from a commit

2026-06-21 05:49:35 +03:00

test(security): export + unit-test resolveTrustProxy (#105)

Ghost referenced this issue

2026-06-21 05:51:20 +03:00

fix: review/red-team batch 2 — 30 issues (security, ws, page-templates, html-embed, mcp, tests, docs) #101

Ghost referenced this issue from a commit

2026-06-21 05:53:55 +03:00