chore(deps): bump github.com/balramadan/distlimit from 1.2.0 to 1.2.1

[dependabot]

Bumps github.com/balramadan/distlimit from 1.2.0 to 1.2.1.

Release notes

Sourced from github.com/balramadan/distlimit's releases.

v1.2.1

🛡️ Release Notes - distlimit v1.2.1

Release Date: October 1, 2026
Tag: v1.2.1
Type: Patch Release (Security Patch & Middleware IP Extraction Hardening)

---

📌 Overview

distlimit version v1.2.1 is a critical security patch addressing IP spoofing vulnerabilities in the X-Forwarded-For header parsing logic across all supported middleware adapters (net/http, Gin, Fiber v3, Echo v4, Echo v5, and gRPC).

Prior to this patch, taking the leftmost element (parts[0]) of the X-Forwarded-For header allowed untrusted clients to bypass IP-based rate limiting by prepending spoofed IP addresses to the header. This release resolves the vulnerability by implementing a robust, RFC-compliant Rightmost Non-Trusted Proxy Traversal algorithm consolidated in internal/xff.

This patch introduces zero breaking changes to the public API surface.

---

🔒 Security Fix Details (CVE / CWE-345 Mitigation)

1. Rightmost Non-Trusted Proxy Traversal

• The Issue: Standard reverse proxies (Nginx, AWS ALB, Cloudflare, HAProxy) append the actual incoming client IP to the right side of the X-Forwarded-For header. The leftmost entry is controlled by the external client. Selecting the leftmost element allowed attackers to evade per-IP rate limits by rotating arbitrary spoofed IPs.
• The Fix: The algorithm now scans X-Forwarded-For in reverse order (right-to-left) using slices.Backward, returning the first IP address that does not match any configured trusted proxy IP or CIDR block.

2. IP Port Stripping & Malformed Entry Sanitization

• Headers containing ports (e.g. 198.51.100.1:443 or [2001:db8::1]:8080) are automatically stripped and normalized before parsing.
• Malformed strings, non-IP garbage, or injected payloads in header entries are safely rejected and skipped during chain traversal.
• X-Real-IP and RemoteAddr fallbacks are strictly validated with net.ParseIP and verified against the trusted proxy list.

---

🏗️ Architectural Improvements

• Consolidated internal/xff Package: Eliminated 6 redundant copies of isTrustedProxy and IP extraction logic across all adapter packages (middleware/nethttp, middleware/gin, middleware/fiber, middleware/echo, middleware/echov5, middleware/grpc).
• Single Source of Truth: Any future proxy normalization or CIDR optimization is now centralized in one maintainable package.
• Public API Stability: Exported ExtractClientIP and ExtractPeerIP signatures remain unchanged as lightweight adapters delegating to xff.ClientIP.

---

🧪 Verification & Quality Control

• Comprehensive Matrix Testing: Added 12 dedicated test scenarios in https://github.com/balramadan/distlimit/blob/HEAD/internal/xff/xff_test.go covering:
  • Leftmost spoofed IP prevention (core security validation)
  • Multi-hop trusted proxy chains
  • IPv4 and IPv6 address with ports and brackets
  • Garbage and injection payload handling
  • Trusted proxy CIDR subnet matching
  • Fallbacks for direct connections and empty headers
• Static Analysis & Data Race Verification:

... (truncated)

Changelog

Sourced from github.com/balramadan/distlimit's changelog.

[v1.2.1] - 2026-10-01

Security

• IP Spoofing Vulnerability (CWE-345): Fixed a security vulnerability where taking the leftmost element (parts[0]) of the X-Forwarded-For header allowed malicious clients to spoof their client IP and bypass rate limits. Replaced with an RFC-compliant Rightmost Non-Trusted Proxy Traversal algorithm.
• Port Stripping & IPv6 Normalization: Automatically strips ports (host:port) and brackets ([2001:db8::1]:port) across X-Forwarded-For, X-Real-IP, and RemoteAddr before evaluation.
• Malformed String Sanitization: Non-IP entries or malicious injection payloads inside X-Forwarded-For and X-Real-IP are safely skipped during traversal.

Changed

• Consolidated IP Extraction (internal/xff): Centralized duplicate ExtractClientIP and isTrustedProxy logic from all 6 middleware packages (nethttp, gin, fiber, echo, echov5, grpc) into a single internal package.

---

Commits

• b5a21bd Merge pull request #5 from balramadan/release/v1.2.1
• a64a7ac docs: add GitHub templates
• ce3286a fix(header): resolve IP spoofing vulnerability by centralizing client IP extr...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)