fix: trim whitespace in parseIpFromHeaders to prevent IP banlist bypass

[Pranjulchaurasiya]

What does this PR do?

Fixes #29851

parseIpFromHeaders split x-forwarded-for on commas but never trimmed
whitespace, so a padded header (or padded array element) would return an
IP with leading/trailing spaces. This caused an exact-match lookup against
IP_BANLIST to fail silently, letting a banned IP bypass the block.

Fix

Added .trim() to the returned value in both the array and string branches.

Tests

• Added unit tests for padded string/array inputs
• Added an end-to-end regression test on isIpInBanlist reproducing the
  reported bypass scenario
• All 21 tests in getIP.test.ts pass locally

Note

I'm aware of #29852, an earlier PR from the issue reporter with a similar
fix — it was withdrawn by the author for unrelated reasons (not a rejection
of the approach), and the issue remains open, so submitting this fix here.

Note: this closes the specific padding-based bypass of the exact-match
IP_BANLIST check. It does not make the banlist airtight against a more
general case of an attacker directly controlling the x-forwarded-for
header value — that's a separate, upstream concern outside this fix's scope.

[github-actions]

Welcome to Cal.diy, @Pranjulchaurasiya! Thanks for opening this pull request.

A few things to keep in mind:

• This is Cal.diy, not Cal.com. Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will not be deployed to the Cal.com production app.
• Please review our Contributing Guidelines if you haven't already.
• Make sure your PR title follows the Conventional Commits format.

A maintainer will review your PR soon. Thanks for contributing!

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: aba1b7e2-9a70-445f-85cb-626a91b35442

📥 Commits

Reviewing files that changed from the base of the PR and between 0d065d1 and 229cba9.

📒 Files selected for processing (1)

• packages/lib/getIP.test.ts

---

📝 Walkthrough

Walkthrough

parseIpFromHeaders now trims whitespace from extracted IP values. Tests cover padded comma-separated strings, padded array elements, and banlist detection when x-forwarded-for contains extra whitespace. Test setup now restores process.env.IP_BANLIST after each regression test.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main fix: trimming whitespace in parseIpFromHeaders to stop banlist bypasses.
Description check	✅ Passed	The description is directly related to the patch and accurately explains the bug, fix, and tests.
Linked Issues check	✅ Passed	The code trims parsed IPs as required and adds regression coverage for the exact whitespace bypass in #29851.
Out of Scope Changes check	✅ Passed	The changes stay focused on the parsing fix and related tests, with no unrelated scope apparent.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/lib/getIP.test.ts`:
- Around line 89-102: Update the afterEach cleanup in the “banlist bypass
regression (`#29851`)” test suite to delete process.env.IP_BANLIST when
originalBanlist is undefined; otherwise restore the saved value normally,
preventing an unset variable from becoming the string "undefined".

In `@packages/lib/getIP.ts`:
- Around line 7-8: Update the IP extraction logic in getIP so empty or sparse
array inputs do not pass undefined to trim; normalize a missing first element to
a safe string before trimming and preserve existing string-header behavior. Add
a regression test covering an empty array and asserting the safe string result.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b50c994f-348a-4c3d-9dba-f33766bf60da

📥 Commits

Reviewing files that changed from the base of the PR and between 3894f37 and d3b3c5f.

📒 Files selected for processing (2)

• packages/lib/getIP.test.ts
• packages/lib/getIP.ts

[CLAassistant]

All committers have signed the CLA.