Finding
Category: duplication (security-adjacent)
File: src/web.cpp:1410-1418, 1437-1450, 1504-1535
Complexity: M
Source: codebase-audit 2026-06-20
Description
enforce_same_origin() (~165 lines) contains the same "lowercase + bracket-aware port-strip + IPv6 zone-ID canonicalization" pipeline three times: once for myHost → hostOnly, and again inside the X-Forwarded-Host block for xFwdHost → xfwdOnly. The IPv6 zone-strip block at lines ~1379–1394 vs ~1455–1468 vs ~1519–1529 is byte-identical.
The risk is not cosmetic: a future fix to handle e.g. [::]:8080 correctly must be applied to all three copies, or CSRF origin-check correctness can diverge between the Host and X-Forwarded-Host paths — exactly the kind of subtle misapplication that CSRF bypasses exploit.
Suggested action
Extract a normalizeHost(const char *in, char *out, size_t outSize) helper that does lowercase, port-strip, and IPv6 zone canonicalization once. Call it for each of the three inputs. Reduces the CSRF guard surface to one auditable function.
Priority / complexity
P2 (security-adjacent — CSRF guard correctness) / M (half day including careful testing)
Finding
Category: duplication (security-adjacent)
File:
src/web.cpp:1410-1418,1437-1450,1504-1535Complexity: M
Source: codebase-audit 2026-06-20
Description
enforce_same_origin()(~165 lines) contains the same "lowercase + bracket-aware port-strip + IPv6 zone-ID canonicalization" pipeline three times: once formyHost → hostOnly, and again inside theX-Forwarded-Hostblock forxFwdHost → xfwdOnly. The IPv6 zone-strip block at lines ~1379–1394 vs ~1455–1468 vs ~1519–1529 is byte-identical.The risk is not cosmetic: a future fix to handle e.g.
[::]:8080correctly must be applied to all three copies, or CSRF origin-check correctness can diverge between the Host and X-Forwarded-Host paths — exactly the kind of subtle misapplication that CSRF bypasses exploit.Suggested action
Extract a
normalizeHost(const char *in, char *out, size_t outSize)helper that does lowercase, port-strip, and IPv6 zone canonicalization once. Call it for each of the three inputs. Reduces the CSRF guard surface to one auditable function.Priority / complexity
P2 (security-adjacent — CSRF guard correctness) / M (half day including careful testing)