DAW/daw-lua-net

Fork 0

fix: ip_utils -- float in create_mask (Lua 5.1), unsafe fallback IP #3

New issue

Closed

opened 2026-05-25 19:57:49 +02:00 by michael · 1 comment

michael commented

2026-05-25 19:57:49 +02:00

Owner

Problems

create_mask uses 2^(31-i) which produces floats in Lua 5.1.
Bitwise operations on floats can give wrong results.
Use integer arithmetic instead.
get_client_ip returns hardcoded "127.0.0.1" as fallback.
If used for IP allowlisting this silently allows localhost
when no IP header is present -- security concern.
Should return nil, err instead.

## Problems 1. create_mask uses 2^(31-i) which produces floats in Lua 5.1. Bitwise operations on floats can give wrong results. Use integer arithmetic instead. 2. get_client_ip returns hardcoded "127.0.0.1" as fallback. If used for IP allowlisting this silently allows localhost when no IP header is present -- security concern. Should return nil, err instead.

michael added the

labels

2026-05-25 19:57:49 +02:00

michael referenced this issue

2026-05-25 20:03:20 +02:00

chore: update daw-lua-net submodule in all hosts after ip_utils fix #4

michael commented

2026-07-25 20:30:56 +02:00

Author

Owner

Fixed as part of the daw-lua-common 2.0.0 migration (DAW/daw-lua-net#6, released as v2.0.0):

create_mask's float issue was already resolved before this session (pow2()
helper using integer multiplication)
get_client_ip no longer has a hardcoded "127.0.0.1" fallback -- it now
requires request.remote_addr explicitly and returns nil, err when it is
missing or invalid, with an optional trusted_proxies parameter for
proxy-header handling

Refs: DAW/daw-lua-net#6

Fixed as part of the daw-lua-common 2.0.0 migration (DAW/daw-lua-net#6, released as v2.0.0): - create_mask's float issue was already resolved before this session (pow2() helper using integer multiplication) - get_client_ip no longer has a hardcoded "127.0.0.1" fallback -- it now requires request.remote_addr explicitly and returns nil, err when it is missing or invalid, with an optional trusted_proxies parameter for proxy-header handling Refs: DAW/daw-lua-net#6

michael

2026-07-25 20:30:57 +02:00

closed this issue
added
status
done
and removed
status
to-go
labels

michael referenced this issue

2026-07-25 20:31:02 +02:00

Migrate to daw-lua-common 2.0.0 #6

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

DAW/daw-lua-net#3

No description provided.

Rows
Columns