Use pytricia for ip matching on non-windows machines#547
Use pytricia for ip matching on non-windows machines#547bitterpanda63 merged 45 commits intomainfrom
Conversation
bitterpanda63
changed the title
![aikido-pr-checks[bot]](https://avatars.githubusercontent.com/in/898896?s=60&v=4){kind=small}
|
|
||
| def test_with_ranges(): | ||
| input_list = [ | ||
| "192.168.0.0/24", |
There was a problem hiding this comment.
Maybe good to test with multiple overlapping ranges too?
There was a problem hiding this comment.
these test cases are from node iirc? (also a bit out of scope, since this was existing code copied over)
| matcher = IPMatcher(input_list) | ||
| assert matcher.has("::ffff:0.0.0.0") == True | ||
| assert matcher.has("::ffff:127.0.0.1") == True | ||
| assert matcher.has("::ffff:123") == False |
There was a problem hiding this comment.
so this case is different for both?
There was a problem hiding this comment.
yes, PyTricia is more accurate in this regard, this is also not a huge issue, and I think no one is running with windows in production. Given IPC also doesnt work
bitterpanda63
force-pushed
the
test-with-pytricia
branch
from
bde96b9 to
21b30a7
Compare
remove ipv4-mapped ipv6 addresses being added manually in imds.py
| # Block the IP address used by Alibaba Cloud | ||
| imds_addresses.add("100.100.100.200") | ||
| imds_addresses.add(map_ipv4_to_ipv6("100.100.100.200")) | ||
| imds_addresses = IPMatcher( |
There was a problem hiding this comment.
imds_addresses is a module-level IPMatcher initialized at import; it will persist across requests and may unintentionally cache data between requests. Consider making it request-scoped or explicitly documenting intended shared cache.
Details
✨ AI Reasoning
A module-level variable is being initialized during import and stored for the process lifetime. This can unintentionally cache request- or environment-specific data between requests/workers, causing cross-request leakage or stale data. The change replaces the prior empty-initialization line with a populated IPMatcher created at module import, increasing the chance that runtime state is shared across requests.
🔧 How do I fix it?
Avoid storing request-specific data in module-level variables. Use request-scoped variables or explicitly mark shared caches as intentional.
Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info
3 participants
Summary by Aikido
🚀 New Features
⚡ Enhancements
🔧 Refactors
More info