>>106283189 (OP)
>>106287936
https://github.com/jart/cosmopolitan/blob/master/net/turfwar/turfwar.c#L1032
988 clientip = ntohl(client.addr.sin_addr.s_addr);
...
1028 ip = clientip;
// get client address from frontend
if (HasHeader(kHttpXForwardedFor)) {
1032 if (!IsLoopbackIp(clientip) && !IsPrivateIp(clientip)) {
...
1039 } else if (ParseForwarded(HeaderData(kHttpXForwardedFor),
HeaderLength(kHttpXForwardedFor), &ip,
0) != -1) {
...
1056 ksnprintf(ipbuf, sizeof(ipbuf), "%hhu.%hhu.%hhu.%hhu", ip >> 24, ip >> 16,
ip >> 8, ip);
...
1230 } else if (UrlStartsWith("/claim")) {
...
1280 } else if (!HasHeader(kHttpAccept) ||
(HeaderHas(msg, inbuf, kHttpAccept, "text/html", 9) ||
HeaderHas(msg, inbuf, kHttpAccept, "text/*", 6) ||
HeaderHas(msg, inbuf, kHttpAccept, "*/*", 3))) {
++g_htmlclaims;
ksnprintf(msgbuf, MSG_BUF,
"\n"
"
The land at %s was claimed for %s.\n"
"
"content=\"width=device-width, initial-scale=1\">\n"
"The land at %s was claimed for
"href=\"/user.html?name=%s\">%s.\n"
"
\nBack to homepage\n",
ipbuf, v.name, ipbuf, v.name, v.name);
...
ip is set as the value of the header in 1039, after verifying (in 1032) that the IPs aren't loopback or private, and then ipbuf is set with this value, which is user-controlled.
the HTML code at the end of this ^ is what you get when you send a claim request.
also, there might be some kind of server-side request forgery or request smiggling allowing this.
