security: validate IP addresses before storage #38

New issue

Open

opened 2026-02-20 03:02:43 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 03:02:43 +00:00

Member

Issue

Models/AgentApiKey.php::recordLastUsedIp() (line 389) doesn't validate IP format.

Current Code

public function recordLastUsedIp(string $ip): self
{
    $this->update(['last_used_ip' => $ip]);
    return $this;
}

Expected Behavior

Validate IP address format before storing.

Acceptance Criteria

Add IP validation (IPv4/IPv6)
Throw exception on invalid IP
Add tests for validation
Document expected format

References

Discovered in security scan
Services/IpRestrictionService.php has validation logic

## Issue `Models/AgentApiKey.php::recordLastUsedIp()` (line 389) doesn't validate IP format. ## Current Code ```php public function recordLastUsedIp(string $ip): self { $this->update(['last_used_ip' => $ip]); return $this; } ``` ## Expected Behavior Validate IP address format before storing. ## Acceptance Criteria - [ ] Add IP validation (IPv4/IPv6) - [ ] Throw exception on invalid IP - [ ] Add tests for validation - [ ] Document expected format ## References - Discovered in security scan - `Services/IpRestrictionService.php` has validation logic