Icycoide/searxng
1
0
Fork 1
mirror of https://github.com/searxng/searxng.git synced 2025-07-18 02:39:27 +02:00
Code Issues Projects Releases Packages Wiki Activity

[mod] botdetection: trusted proxies

Browse source 
Replaces `x_for` functionality with `trusted_proxies`. This allows defining which IP / ranges to trust extracting the client IP address from X-Forwarded-For and X-Real-IP headers.

We don't know if the proxy chain will give us the proper client address, so we rely on reading the headers of the proxy before SearXNG (if there is one, in that case it must be added to trusted_proxies) hoping it has done the proper checks. In case a proxy in the chain does not check the client address correctly, integrity is compromised and this should be fixed by whoever manages the proxy, not us.

I had to move the get_cnf func to another file (config.py) to prevent cyclic imports since we need to read the list inside _helpers.py

Closes https://github.com/searxng/searxng/issues/4907
Closes https://github.com/searxng/searxng/issues/3632
Closes https://github.com/searxng/searxng/issues/3191
Closes https://github.com/searxng/searxng/issues/1237

Related https://github.com/searxng/searxng-docker/issues/386
Related https://github.com/inetol-infrastructure/searxng-container/issues/81
This commit is contained in:
Ivan Gabaldon 2025-06-12 14:16:09 +02:00
parent 4b9644eb27
commit eb9f20a823
No known key found for this signature in database
GPG key ID: 075587C93FA67582
10 changed files with 147 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

28
tests/unit/test_plugin_self_info.py
View file

@ -8,7 +8,7 @@ from flask_babel import gettext
import searx.plugins
import searx.preferences
import searx.limiter
import searx.botdetection
import searx.botdetection.config
from searx.extended_types import sxng_request
from searx.result_types import Answer
@ -29,19 +29,34 @@ class PluginIPSelfInfo(SearxTestCase):
self.pref = searx.preferences.Preferences(["simple"], ["general"], engines, self.storage)
self.pref.parse_dict({"locale": "en"})
cfg = searx.limiter.get_cfg()
cfg = searx.botdetection.config.get_cfg()
searx.botdetection.init(cfg, None)
def test_plugin_store_init(self):
self.assertEqual(1, len(self.storage))
def test_pageno_1_2(self):
def test_v4_pageno_1_2(self):
with self.app.test_request_context():
sxng_request.preferences = self.pref
sxng_request.remote_addr = "127.0.0.1"
sxng_request.headers = {"X-Forwarded-For": "1.2.3.4, 127.0.0.1", "X-Real-IP": "127.0.0.1"} # type: ignore
answer = Answer(answer=gettext("Your IP is: ") + "127.0.0.1")
sxng_request.headers = {"X-Forwarded-For": "1.2.3.4, 127.0.0.1", "X-Real-IP": ""} # type: ignore
answer = Answer(answer=gettext("Your IP is: ") + "1.2.3.4")
search = do_post_search("ip", self.storage, pageno=1)
self.assertIn(answer, search.result_container.answers)
search = do_post_search("ip", self.storage, pageno=2)
self.assertEqual(list(search.result_container.answers), [])
def test_v6_pageno_1_2(self):
with self.app.test_request_context():
sxng_request.preferences = self.pref
sxng_request.remote_addr = "::1"
sxng_request.headers = { # type: ignore
"X-Forwarded-For": "fd0f:a306:f289:0000:0000:0000:ffff:baba, ::1, 127.0.0.1",
"X-Real-IP": "fd0f:a306:f289:0000:0000:0000:ffff:baba",
}
answer = Answer(answer=gettext("Your IP is: ") + "fd0f:a306:f289::ffff:baba")
search = do_post_search("ip", self.storage, pageno=1)
self.assertIn(answer, search.result_container.answers)
@ -56,7 +71,6 @@ class PluginIPSelfInfo(SearxTestCase):
]
)
def test_user_agent_in_answer(self, query: str):
query = "user-agent"
with self.app.test_request_context():