fix(tomcat): Regex escaping error in RemoteIpValve internalProxies + missing CGNAT
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 84/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Domain
- devops, infrastructure
Research direction
Start at dotCMS/src/main/resources/container/tomcat9/bin/setenv.sh:102 and inspect how the default CMS_REMOTEIP_INTERNALPROXIES value is quoted and passed to Tomcat's RemoteIpValve. Deploy without the environment variable and reproduce the listed internal-proxy requests; done means RFC 1918, CGNAT, loopback, and link-local proxies are trusted and X-Forwarded-For resolves the client IP.
Written by the indexing model from the issue text.
Description
Problem Statement
The default CMS_REMOTEIP_INTERNALPROXIES regex in setenv.sh uses double-backslash escaping (\\) inside double-quoted strings. This produces an incorrect regex pattern that fails to match internal proxy IP addresses, causing RemoteIpValve to not trust proxies and not properly resolve client IPs from X-Forwarded-For headers.
Additionally, the regex does not cover 100.64.0.0/10 (CGNAT, RFC 6598), commonly used by cloud load balancers and Kubernetes overlay networks. Tomcat 10.1+ includes this range by default.
File: dotCMS/src/main/resources/container/tomcat9/bin/setenv.sh:102
Current (broken):
export CMS_REMOTEIP_INTERNALPROXIES=${CMS_REMOTEIP_INTERNALPROXIES:-"10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3} |192\\.168\\.\\d{1,3}\\.\\d{1,3}|..."}
The \\ escaping is incorrect — should be single \.
Steps to Reproduce
- Deploy dotCMS without setting
CMS_REMOTEIP_INTERNALPROXIESenv var - Send request through an internal proxy (e.g.,
10.x.x.x,192.168.x.x) - Observe
X-Forwarded-Forheader is not resolved — client IP shows proxy IP instead of real client IP - Requests from CGNAT range (
100.64.x.x) are never trusted regardless of escaping fix
Acceptance Criteria
- Fix
\\double-backslash escaping to single\inCMS_REMOTEIP_INTERNALPROXIESdefault regex insetenv.sh - Add
100.64.0.0/10(CGNAT / RFC 6598) to internal proxies regex - RemoteIpValve correctly matches RFC 1918, CGNAT, loopback, and link-local addresses as internal proxies
-
X-Forwarded-Forheader properly resolved when request traverses internal proxy
dotCMS Version
All versions (evergreen) — present since the regex was added to setenv.sh
Severity
Medium - Some functionality impacted
Links
- Dominant language
- Java
- Stars
- 970
- Forks
- 486
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 164
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from dotCMS/core
-
dotCMS : Build Team : Falcon Type : Task
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
OKR : Customer Support Team : Maintenance
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
Team : Modernization
Difficulty 1/5 Under an hour Newbie friendliness 78/100
-
dotCMS : Workflow Team : Cloud Eng
Difficulty 2/5 1-3 hours Newbie friendliness 87/100
-
Team : Maintenance
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
infinispan/infinispan#18150 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
opensearch-project/k-NN#3597 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100