peptide-repo/peptide-starter-theme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

v1.5.2: CF-peer validated client IP, grandfather migration, de-short-circuit register

Browse Source 
Security follow-up to v1.5.1. Closes four items from the v1.5.1 review —
two ship-blockers and two mediums — all within the ADR-0001 envelope.

PSEC-007 — peptide_starter_get_client_ip() now trusts CF-Connecting-IP
only when REMOTE_ADDR falls inside a published Cloudflare edge range.
Previously, any direct-to-origin request (which Hostinger permits) could
forge its rate-limit key by setting the header to a different IP per
attempt, bypassing every abuse control in the theme. New module
inc/cloudflare-ips.php embeds a dated snapshot of CF v4/v6 ranges and a
CIDR matcher covering both families; list is overridable via the
peptide_starter_cloudflare_ip_ranges filter for out-of-band updates.
HTTP_X_FORWARDED_FOR stays ignored unless operators opt in via the
peptide_starter_trust_xff filter.

PSEC-008 — Removed the v1.5.1 user-verification migration (Option A as
confirmed by peptiderepo). The sync-wp_mail-per-subscriber loop on
admin_init would have blocked wp-admin and hammered deliverability.
Existing accounts are now grandfathered: no ps_pending_verification
meta = verified. Verification applies only to registrations from v1.5.2
forward. The ps_verify_migration_version option (written by v1.5.1) is
cleared on theme activation.

PSEC-009 — Registration validation no longer short-circuits. All five
checks (username pattern, email validity, password length,
username_exists, email_exists) evaluate unconditionally before the
combined rejection. Closes the response-time oracle that let an
attacker distinguish microsecond-fast regex rejection from DB-round-trip
rejection and infer which field triggered the failure.

PSEC-010 — Added the happy-path verify test that v1.5.1 was missing.
Covers token match, user meta cleanup, auth cookie set, and the
peptide_starter_user_verified action firing with the correct user ID.

Seven new rate-limiter tests confirm CF-peer validation works
end-to-end: trusted CF peer honours the header, untrusted peer ignores
spoofed headers, invalid values fall through, XFF default-off, XFF
filter opt-in, CF range filter override, IPv6 CIDR match, family
mismatch rejection.

Confirmed with peptiderepo before coding: (1) Option A for PSEC-008
because zero users; (2) Cloudflare IS in front of the origin (dig
confirms 104.21.x / 172.67.x + CF-Ray response header), so PSEC-007 is
a real fix not dead code; (3) no staging — treat prod as staging.

ARCHITECTURE.md gains a client-IP trust model section; CONVENTIONS.md
documents the header-trust rules for future modules.

Version bumped to 1.5.2 in style.css and functions.php.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
peptiderepo
2026-04-14 15:39:09 +07:00
parent 3e1c12c94b
commit fff3fce432
13 changed files with 573 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files

59
tests/test-rate-limiter.php
View File

@@ -78,17 +78,66 @@ class Test_Rate_Limiter extends WP_UnitTestCase {
$this->assertStringNotContainsString( 'alice', $a );
}
public function test_client_ip_prefers_cf_header() {
public function test_client_ip_trusts_cf_header_when_peer_is_cloudflare() {
// 172.68.0.5 is inside 172.64.0.0/13 (published CF range).
$_SERVER['REMOTE_ADDR'] = '172.68.0.5';
$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_rejects_garbage() {
public function test_client_ip_ignores_spoofed_cf_header_from_non_cloudflare_peer() {
// 8.8.8.8 is not Cloudflare — any CF-Connecting-IP header must be
// treated as hostile and ignored. This is PSEC-007.
$_SERVER['REMOTE_ADDR'] = '8.8.8.8';
$_SERVER['HTTP_CF_CONNECTING_IP'] = '203.0.113.5';
$this->assertSame( '8.8.8.8', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_rejects_invalid_cf_header_value() {
$_SERVER['REMOTE_ADDR'] = '172.68.0.5';
$_SERVER['HTTP_CF_CONNECTING_IP'] = 'not-an-ip';
$this->assertSame( '172.68.0.5', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_ignores_xff_by_default() {
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$_SERVER['HTTP_X_FORWARDED_FOR'] = '203.0.113.5';
$this->assertSame( '10.0.0.1', peptide_starter_get_client_ip() );
unset( $_SERVER['HTTP_CF_CONNECTING_IP'] );
unset( $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['REMOTE_ADDR'] );
}
public function test_client_ip_respects_xff_when_filter_enables_trust() {
$_SERVER['REMOTE_ADDR'] = '10.0.0.1';
$_SERVER['HTTP_X_FORWARDED_FOR'] = '203.0.113.5, 172.68.0.5';
add_filter( 'peptide_starter_trust_xff', '__return_true' );
$this->assertSame( '203.0.113.5', peptide_starter_get_client_ip() );
remove_filter( 'peptide_starter_trust_xff', '__return_true' );
unset( $_SERVER['HTTP_X_FORWARDED_FOR'], $_SERVER['REMOTE_ADDR'] );
}
public function test_cloudflare_ranges_filter_override_is_honoured() {
add_filter(
'peptide_starter_cloudflare_ip_ranges',
function () {
return array( 'v4' => array( '10.0.0.0/8' ), 'v6' => array() );
}
);
// Default snapshot would treat 172.68.0.5 as CF; filter override
// should now treat 10.0.0.5 as CF instead.
$this->assertTrue( peptide_starter_is_cloudflare_peer( '10.0.0.5' ) );
$this->assertFalse( peptide_starter_is_cloudflare_peer( '172.68.0.5' ) );
remove_all_filters( 'peptide_starter_cloudflare_ip_ranges' );
}
public function test_cidr_match_handles_ipv6() {
$this->assertTrue( peptide_starter_cidr_match( '2606:4700::1234', '2606:4700::/32' ) );
$this->assertFalse( peptide_starter_cidr_match( '2001:db8::1', '2606:4700::/32' ) );
}
public function test_cidr_match_rejects_family_mismatch() {
$this->assertFalse( peptide_starter_cidr_match( '203.0.113.5', '2606:4700::/32' ) );
}
}