shiyue/cc-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: remove hardcoded whitelist IP

Browse Source 
Move extra whitelist IPs to CC_WEB_IP_WHITELIST env var to avoid committing public IPs.
This commit is contained in:
cc-dan
2026-03-16 12:09:17 +00:00
parent c454cfa0ad
commit aa9b3a6bb4
1 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
server.js
View File

@@ -439,11 +439,24 @@ const AUTH_FAIL_MAX = 3;
const authFailures = new Map(); // ip -> [timestamp, ...] const authFailures = new Map(); // ip -> [timestamp, ...]
let bannedIPs = new Set(); let bannedIPs = new Set();
// Tailscale / loopback whitelist — never ban these IPs // Tailscale / loopback whitelist — never ban these IPs.
// Extra whitelist can be provided via env var (comma/space separated):
// CC_WEB_IP_WHITELIST="<ip1>,<ip2>"
const EXTRA_WHITELIST_IPS = new Set(
String(process.env.CC_WEB_IP_WHITELIST || '')
.split(/[\s,]+/)
.map(s => s.trim())
.filter(Boolean)
.map(s => s.replace(/^::ffff:/, ''))
);
function isWhitelistedIP(ip) { function isWhitelistedIP(ip) {
if (!ip) return false; if (!ip) return false;
const cleaned = ip.replace(/^::ffff:/, ''); const cleaned = ip.replace(/^::ffff:/, '');
return cleaned === '127.0.0.1' || cleaned === '::1' || cleaned.startsWith('100.') || cleaned === ''; return cleaned === '127.0.0.1'
|| cleaned === '::1'
|| cleaned.startsWith('100.')
|| EXTRA_WHITELIST_IPS.has(cleaned);
} }
function loadBannedIPs() { function loadBannedIPs() {