Granny's Programming Pearls
"inside of every large program is a small program struggling to get out"
JavaRanch.com/granny.jsp
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Minor security issue with IP address detection...

 
Migrated From Jforum.net
Ranch Hand
Posts: 17424
  • 0
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Just a note to everyone that there is a minor security issue in the handling of IP addresses.
function public String getRemoteAddr() in src/net/jforum/context/web/WebRequestContext will try and get an IP address from the x-forwarded-for HTTP header. It is possible to send a fake header and therefore fake the IP address. A fake IP address can be targeted to any other user on the site, and by posting illegal content, they might be able to trick a mod into banning an IP address, and therefore banning an innocent user.
You can fix this by changing the content of this function to just:
return super.getRemoteAddr();
but this will return proxy server IP addresses instead of specific IP addresses, which could lead to innocent users getting blocked as well. It is probably marginally safer to use this option though as it prevents deliberate targeting of established innocent users and it prevents users from setting up unblockable abusive accounts.

Thanks again for the great forum software! I have not found any other security issues whilst auditing it so far
[originally posted on jforum.net by legoburner]
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic