Don't allow 0.0.0.0 (skot#665)

WantClue · Jan 27, 2025 · 1db16a5 · 1db16a5
1 parent c8671cf
commit 1db16a5
Showing 1 changed file with 9 additions and 11 deletions.
diff --git a/main/http_server/http_server.c b/main/http_server/http_server.c
@@ -82,19 +82,11 @@ static esp_err_t ip_in_private_range(uint32_t address) {
     return ESP_FAIL;
 }
 
-static uint32_t extract_origin_ip_addr(httpd_req_t *req)
+static uint32_t extract_origin_ip_addr(char *origin)
 {
-    char origin[128];
     char ip_str[16];
     uint32_t origin_ip_addr = 0;
 
-    // Attempt to get the Origin header.
-    if (httpd_req_get_hdr_value_str(req, "Origin", origin, sizeof(origin)) != ESP_OK) {
-        ESP_LOGD(CORS_TAG, "No origin header found.");
-        return 0;
-    }
-    ESP_LOGD(CORS_TAG, "Origin header: %s", origin);
-
     // Find the start of the IP address in the Origin header
     const char *prefix = "http://";
     char *ip_start = strstr(origin, prefix);
@@ -148,8 +140,14 @@ static esp_err_t is_network_allowed(httpd_req_t * req)
     // Convert to IPv4 string
     inet_ntop(AF_INET, &request_ip_addr, ipstr, sizeof(ipstr));
 
-    uint32_t origin_ip_addr = extract_origin_ip_addr(req);
-    if (origin_ip_addr == 0) {
+    // Attempt to get the Origin header.
+    char origin[128];
+    uint32_t origin_ip_addr;
+    if (httpd_req_get_hdr_value_str(req, "Origin", origin, sizeof(origin)) == ESP_OK) {
+        ESP_LOGD(CORS_TAG, "Origin header: %s", origin);
+        origin_ip_addr = extract_origin_ip_addr(origin);
+    } else {
+        ESP_LOGD(CORS_TAG, "No origin header found.");
         origin_ip_addr = request_ip_addr;
     }