fix(security): improve TeapotController header sanitization #21

Merged

Charon merged 1 commit from security/improve-teapot-sanitization into main

2026-02-20 12:10:59 +00:00

Clotho commented

2026-02-20 11:59:03 +00:00

Member

Summary

Switch header storage from blacklist to whitelist — only headers useful for bot detection are now kept
Replace naive localhost check with isPrivateIp() covering IPv4-mapped IPv6, Docker bridge, and all RFC 1918 ranges
Validate referer header as a URL before storing; malformed values are replaced with invalid-url

Closes #13

Test plan

Existing header sanitisation test updated to verify whitelist behaviour
New tests: IPv4/IPv6 loopback, IPv4-mapped IPv6, private ranges (10.x, 172.x, 192.168.x), public IPs
New tests: valid URL referer stored, invalid referer replaced, empty referer handled
Integration tests updated to use public IPs where auto-block is expected
PHP syntax checks pass

🤖 Generated with Claude Code

## Summary - Switch header storage from blacklist to whitelist — only headers useful for bot detection are now kept - Replace naive localhost check with `isPrivateIp()` covering IPv4-mapped IPv6, Docker bridge, and all RFC 1918 ranges - Validate referer header as a URL before storing; malformed values are replaced with `invalid-url` Closes #13 ## Test plan - [x] Existing header sanitisation test updated to verify whitelist behaviour - [x] New tests: IPv4/IPv6 loopback, IPv4-mapped IPv6, private ranges (10.x, 172.x, 192.168.x), public IPs - [x] New tests: valid URL referer stored, invalid referer replaced, empty referer handled - [x] Integration tests updated to use public IPs where auto-block is expected - [x] PHP syntax checks pass 🤖 Generated with [Claude Code](https://claude.ai/claude-code)

Clotho added 1 commit 2026-02-20 11:59:03 +00:00

fix(security): improve TeapotController header sanitization (#13 )

CI / PHP 8.2 (pull_request) Failing after 1s

Details

CI / PHP 8.4 (pull_request) Failing after 1s

Details

CI / PHP 8.3 (pull_request) Failing after 1s

Details

CI / Assets (pull_request) Failing after 1s

Details

163d34aacf

Switch header storage from blacklist to whitelist approach, add private
IP detection for auto-block bypass, and validate referer URLs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>