fix: support for IPv6 address literals in HOST env var - #2614
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughHost and port resolution is centralized with IPv6 literal support, and server-side page requests use the helper. Server startup now captures the HTTP server and handles listen errors. ChangesRuntime networking
Estimated code review effort: 3 (Moderate) | ~20 minutes Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/utils/urlHelper.ts`:
- Around line 3-5: The current host-wrapping logic in src/utils/urlHelper.ts
blindly brackets any host containing ':' which double-brackets already-bracketed
IPv6 literals; update the guard in the host handling (the block that checks
host.includes(':')) to first detect if host already startsWith('[') and
endsWith(']') and only wrap with `[...]` when those brackets are absent, leaving
already-bracketed values unchanged.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
src/pages/_app.tsxsrc/pages/collection/[collectionId]/index.tsxsrc/pages/movie/[movieId]/index.tsxsrc/pages/tv/[tvId]/index.tsxsrc/utils/urlHelper.ts
There was a problem hiding this comment.
Pull request overview
Adds a shared helper for constructing internal HOST:PORT strings so server-side page requests can correctly target IPv6 address literals (by bracketing them) when building URLs for local API calls.
Changes:
- Introduced
getHostAndPort()utility for consistent internal host/port formatting (including IPv6 bracketing). - Updated server-side Axios calls in
_appand several detail pages to use the new helper instead of inlineprocess.env.HOST/process.env.PORTstring concatenation.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| src/utils/urlHelper.ts | Adds centralized host/port formatting used for internal API URL construction. |
| src/pages/_app.tsx | Switches internal settings/user Axios requests to use the shared host/port helper. |
| src/pages/movie/[movieId]/index.tsx | Uses the shared host/port helper for server-side movie detail API calls. |
| src/pages/tv/[tvId]/index.tsx | Uses the shared host/port helper for server-side TV detail API calls. |
| src/pages/collection/[collectionId]/index.tsx | Uses the shared host/port helper for server-side collection detail API calls. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Maybe overkill but this lib could help : https://www.npmjs.com/package/ip-address |
Yeah probably overkill. Worst case you don't properly configure the host address and the app crashes at startup? |
Correct. However, I noticed this error wasn't being caught and logged so I updated the PR for this. Example logs when |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
server/index.ts (1)
281-284: Consider using structured logging for consistency.The error handler works correctly. For consistency with other logging calls in this file (e.g., lines 270, 276), consider using the structured format with a
labelproperty.♻️ Suggested improvement
httpServer.on('error', (err) => { - logger.error('Listen error:', err); + logger.error('Failed to start server', { + label: 'Server', + message: err.message, + }); process.exit(1); });🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@server/index.ts` around lines 281 - 284, Update the httpServer error handler to use the same structured logging shape as other calls: replace the freeform logger.error('Listen error:', err) in the httpServer.on('error', (err) => { ... }) callback with a single structured call that passes an object including a label (e.g., label: 'server:listen') and the error (e.g., err) so the log matches the format used at lines like the other logger.error/logger.info calls; ensure you only modify the logger.error invocation inside the httpServer.on('error') handler to emit the label and error fields.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@server/index.ts`:
- Around line 281-284: Update the httpServer error handler to use the same
structured logging shape as other calls: replace the freeform
logger.error('Listen error:', err) in the httpServer.on('error', (err) => { ...
}) callback with a single structured call that passes an object including a
label (e.g., label: 'server:listen') and the error (e.g., err) so the log
matches the format used at lines like the other logger.error/logger.info calls;
ensure you only modify the logger.error invocation inside the
httpServer.on('error') handler to emit the label and error fields.
|
This PR is stale because it has been open 30 days with no activity. Please address the feedback or provide an update to keep it open. |
|
Hey @kouellette can you review the two comments we did so we can merge your PR |
|
This PR is stale because it has been open 30 days with no activity. Please address the feedback or provide an update to keep it open. |
|
This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged. |
When pages would build URLs for API requests, process.env.HOST would be directly concatenated with process.env.PORT (e.g., `0.0.0.0:5055`). This works for IPv4 address literals but does not work for IPv6 address literals because `:::5055` for example is invalid. This commit adds a check if process.env.HOST contains a colon (:) and if so, wraps the host in square brackets. E.g., `[::]:5055`, which is valid. This allows for users to set the HOST environment variable to IPv6 address literals. fix seerr-team#2612
Accepted @fallenbagel suggestion Co-authored-by: fallenbagel <98979876+fallenbagel@users.noreply.github.com>
Apply PR suggestion from @M0NsTeRRR to use the Address6.isValid util from the ip-address package.
bd64a92 to
c9c2b22
Compare
|
Thanks for your contribution @kouellette ! |
seerr
|
||||||||||||||||||||||||||||
| Project |
seerr
|
| Branch Review |
develop
|
| Run status |
|
| Run duration | 02m 50s |
| Commit |
|
| Committer | Kyle Ouellette |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
|
|
0
|
|
|
1
|
|
|
0
|
|
|
0
|
|
|
33
|
| View all changes introduced in this branch ↗︎ | |
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [seerr/seerr](https://github.com/seerr-team/seerr) | minor | `v3.3.0` → `v3.4.0` | --- ### Release Notes <details> <summary>seerr-team/seerr (seerr/seerr)</summary> ### [`v3.4.0`](https://github.com/seerr-team/seerr/releases/tag/v3.4.0) [Compare Source](seerr-team/seerr@v3.3.0...v3.4.0) This release patches a path traversal vulnerability in the avatar image proxy. Exploitation vectors: - A malicious or compromised Jellyfin/Emby media server returning a crafted HTTP response. - A man-in-the-middle attacker intercepting the connection to the media server, if it is configured over HTTP instead of HTTPS (the default setting). ##### 🛡️ Security - Patch [GHSA-mc6w-69r3-62h8](GHSA-mc6w-69r3-62h8) - Path Traversal leading to Remote Code Execution vulnerability (in seerr's ImageProxy) - ([f484791](seerr-team/seerr@f484791)) ##### 🚀 Features - *(PlexImportModal)* Add user details sync functionality ([#​2977](seerr-team/seerr#2977)) - ([902b88e](seerr-team/seerr@902b88e)) - *(api)* Support `userId` when creating issues ([#​3100](seerr-team/seerr#3100)) - ([5f2722d](seerr-team/seerr@5f2722d)) - *(external-links)* Add Simkl media link ([#​3121](seerr-team/seerr#3121)) - ([5ae70d0](seerr-team/seerr@5ae70d0)) - *(notifications)* Add Discord thread ID support ([#​3065](seerr-team/seerr#3065)) - ([6e9ba06](seerr-team/seerr@6e9ba06)) - *(requests)* Allow admins to bypass user quota limits ([#​2026](seerr-team/seerr#2026)) - ([72536da](seerr-team/seerr@72536da)) - Allow to disable version check ([#​3137](seerr-team/seerr#3137)) - ([73937c0](seerr-team/seerr@73937c0)) - Add jellyfin/emby quick connect authentication ([#​2212](seerr-team/seerr#2212)) - ([74c8db4](seerr-team/seerr@74c8db4)) ##### 🐛 Bug Fixes - *(availability-sync)* Prevent false removals for merged-version Plex items ([#​3224](seerr-team/seerr#3224)) - ([46d8033](seerr-team/seerr@46d8033)) - *(discover)* Use added sort in recent requests slider ([#​3202](seerr-team/seerr#3202)) - ([8ccd0f6](seerr-team/seerr@8ccd0f6)) - *(email)* Respect hosts file for SMTP connections ([#​3082](seerr-team/seerr#3082)) - ([b660201](seerr-team/seerr@b660201)) - *(i18n)* Fallback to server locale for "Default" user lang in notifs ([#​3190](seerr-team/seerr#3190)) - ([ef9edc8](seerr-team/seerr@ef9edc8)) - *(next)* Add next-env.d.ts to .gitignore ([#​3282](seerr-team/seerr#3282)) - ([3279393](seerr-team/seerr@3279393)) - *(notifications)* Make the Discord IDs available even when the notification is disabled on Seerr ([#​3139](seerr-team/seerr#3139)) - ([a8f1780](seerr-team/seerr@a8f1780)) - *(proxy)* Proxy clients built before proxy init ([#​3196](seerr-team/seerr#3196)) - ([8ad191f](seerr-team/seerr@8ad191f)) - *(scanners)* Decline orphaned requests when media is removed from servarr ([#​3191](seerr-team/seerr#3191)) - ([2e0e4ce](seerr-team/seerr@2e0e4ce)) - *(subscriber)* Await request status updates ([#​3223](seerr-team/seerr#3223)) - ([f481b56](seerr-team/seerr@f481b56)) - *(ui)* Revalidate request list after approving or declining a request ([#​3283](seerr-team/seerr#3283)) - ([e810b98](seerr-team/seerr@e810b98)) - *(webpush)* Guard subscriptions request until user loads ([#​3113](seerr-team/seerr#3113)) - ([6829850](seerr-team/seerr@6829850)) - Support for IPv6 address literals in HOST env var ([#​2614](seerr-team/seerr#2614)) - ([0adbf50](seerr-team/seerr@0adbf50)) - Prevent cross-instance external ID collisions ([#​3203](seerr-team/seerr#3203)) - ([8e02d92](seerr-team/seerr@8e02d92)) - Close manage movie sidebar without back reopening ([#​2590](seerr-team/seerr#2590)) - ([0a1f703](seerr-team/seerr@0a1f703)) - Availability sync demotion and orphan season rollup edge cases ([#​3148](seerr-team/seerr#3148)) - ([784faa9](seerr-team/seerr@784faa9)) ##### 📖 Documentation - *(blog)* Rootless design and PUID/PGID rationale ([#​3105](seerr-team/seerr#3105)) - ([bf5323f](seerr-team/seerr@bf5323f)) - *(blog)* Fix "monitorNewItems" feature description and previous post author ([#​3103](seerr-team/seerr#3103)) - ([4e7a227](seerr-team/seerr@4e7a227)) - Update truenas migration section to include chown ([#​3143](seerr-team/seerr#3143)) - ([ebac489](seerr-team/seerr@ebac489)) - Add TrueNAS migration guidance ([#​3107](seerr-team/seerr#3107)) - ([8b062ed](seerr-team/seerr@8b062ed)) ##### ⚙️ Miscellaneous Tasks - *(actions)* Update github actions ([#​3041](seerr-team/seerr#3041)) - ([0438710](seerr-team/seerr@0438710)) - *(dev)* Add devenv setup ([#​3138](seerr-team/seerr#3138)) - ([d2ffe4f](seerr-team/seerr@d2ffe4f)) - *(i18n)* Update translations from Weblate - ([4b65ab5](seerr-team/seerr@4b65ab5)) - *(i18n)* Update translations from Weblate - ([1926095](seerr-team/seerr@1926095)) - *(i18n)* Update translations from Weblate - ([d051deb](seerr-team/seerr@d051deb)) - *(i18n)* Update translations from Weblate - ([8d351bc](seerr-team/seerr@8d351bc)) - *(i18n)* Update translations from Weblate - ([3f33842](seerr-team/seerr@3f33842)) - *(i18n)* Update translations from Weblate - ([6c8527f](seerr-team/seerr@6c8527f)) - *(i18n)* Update translations from Weblate - ([ab26f06](seerr-team/seerr@ab26f06)) - *(i18n)* Update translations from Weblate - ([0a305f6](seerr-team/seerr@0a305f6)) - *(i18n)* Update translations from Weblate - ([32249f2](seerr-team/seerr@32249f2)) - *(i18n)* Update translations from Weblate - ([2a249a8](seerr-team/seerr@2a249a8)) - *(release)* Prepare v3.4.0 - ([2dbe886](seerr-team/seerr@2dbe886)) - *(release)* Prepare 3.4.0 release - ([b21049a](seerr-team/seerr@b21049a)) ##### New Contributors ❤️ - [@​aaamoeder](https://github.com/aaamoeder) made their first contribution - [@​kouellette](https://github.com/kouellette) made their first contribution - [@​u61d](https://github.com/u61d) made their first contribution - [@​thraizz](https://github.com/thraizz) made their first contribution - [@​john-fletcher](https://github.com/john-fletcher) made their first contribution - [@​Gilmoursa](https://github.com/Gilmoursa) made their first contribution - [@​atoy3731](https://github.com/atoy3731) made their first contribution - [@​nightt5879](https://github.com/nightt5879) made their first contribution </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1745
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [seerr/seerr](https://github.com/seerr-team/seerr) | minor | `v3.3.0` → `v3.4.0` | --- ### Release Notes <details> <summary>seerr-team/seerr (seerr/seerr)</summary> ### [`v3.4.0`](https://github.com/seerr-team/seerr/releases/tag/v3.4.0) [Compare Source](seerr-team/seerr@v3.3.0...v3.4.0) This release patches a path traversal vulnerability in the avatar image proxy. Exploitation vectors: - A malicious or compromised Jellyfin/Emby media server returning a crafted HTTP response. - A man-in-the-middle attacker intercepting the connection to the media server, if it is configured over HTTP instead of HTTPS (the default setting). ##### 🛡️ Security - Patch [GHSA-mc6w-69r3-62h8](GHSA-mc6w-69r3-62h8) - Path Traversal leading to Remote Code Execution vulnerability (in seerr's ImageProxy) - ([f484791](seerr-team/seerr@f484791)) ##### 🚀 Features - *(PlexImportModal)* Add user details sync functionality ([#​2977](seerr-team/seerr#2977)) - ([902b88e](seerr-team/seerr@902b88e)) - *(api)* Support `userId` when creating issues ([#​3100](seerr-team/seerr#3100)) - ([5f2722d](seerr-team/seerr@5f2722d)) - *(external-links)* Add Simkl media link ([#​3121](seerr-team/seerr#3121)) - ([5ae70d0](seerr-team/seerr@5ae70d0)) - *(notifications)* Add Discord thread ID support ([#​3065](seerr-team/seerr#3065)) - ([6e9ba06](seerr-team/seerr@6e9ba06)) - *(requests)* Allow admins to bypass user quota limits ([#​2026](seerr-team/seerr#2026)) - ([72536da](seerr-team/seerr@72536da)) - Allow to disable version check ([#​3137](seerr-team/seerr#3137)) - ([73937c0](seerr-team/seerr@73937c0)) - Add jellyfin/emby quick connect authentication ([#​2212](seerr-team/seerr#2212)) - ([74c8db4](seerr-team/seerr@74c8db4)) ##### 🐛 Bug Fixes - *(availability-sync)* Prevent false removals for merged-version Plex items ([#​3224](seerr-team/seerr#3224)) - ([46d8033](seerr-team/seerr@46d8033)) - *(discover)* Use added sort in recent requests slider ([#​3202](seerr-team/seerr#3202)) - ([8ccd0f6](seerr-team/seerr@8ccd0f6)) - *(email)* Respect hosts file for SMTP connections ([#​3082](seerr-team/seerr#3082)) - ([b660201](seerr-team/seerr@b660201)) - *(i18n)* Fallback to server locale for "Default" user lang in notifs ([#​3190](seerr-team/seerr#3190)) - ([ef9edc8](seerr-team/seerr@ef9edc8)) - *(next)* Add next-env.d.ts to .gitignore ([#​3282](seerr-team/seerr#3282)) - ([3279393](seerr-team/seerr@3279393)) - *(notifications)* Make the Discord IDs available even when the notification is disabled on Seerr ([#​3139](seerr-team/seerr#3139)) - ([a8f1780](seerr-team/seerr@a8f1780)) - *(proxy)* Proxy clients built before proxy init ([#​3196](seerr-team/seerr#3196)) - ([8ad191f](seerr-team/seerr@8ad191f)) - *(scanners)* Decline orphaned requests when media is removed from servarr ([#​3191](seerr-team/seerr#3191)) - ([2e0e4ce](seerr-team/seerr@2e0e4ce)) - *(subscriber)* Await request status updates ([#​3223](seerr-team/seerr#3223)) - ([f481b56](seerr-team/seerr@f481b56)) - *(ui)* Revalidate request list after approving or declining a request ([#​3283](seerr-team/seerr#3283)) - ([e810b98](seerr-team/seerr@e810b98)) - *(webpush)* Guard subscriptions request until user loads ([#​3113](seerr-team/seerr#3113)) - ([6829850](seerr-team/seerr@6829850)) - Support for IPv6 address literals in HOST env var ([#​2614](seerr-team/seerr#2614)) - ([0adbf50](seerr-team/seerr@0adbf50)) - Prevent cross-instance external ID collisions ([#​3203](seerr-team/seerr#3203)) - ([8e02d92](seerr-team/seerr@8e02d92)) - Close manage movie sidebar without back reopening ([#​2590](seerr-team/seerr#2590)) - ([0a1f703](seerr-team/seerr@0a1f703)) - Availability sync demotion and orphan season rollup edge cases ([#​3148](seerr-team/seerr#3148)) - ([784faa9](seerr-team/seerr@784faa9)) ##### 📖 Documentation - *(blog)* Rootless design and PUID/PGID rationale ([#​3105](seerr-team/seerr#3105)) - ([bf5323f](seerr-team/seerr@bf5323f)) - *(blog)* Fix "monitorNewItems" feature description and previous post author ([#​3103](seerr-team/seerr#3103)) - ([4e7a227](seerr-team/seerr@4e7a227)) - Update truenas migration section to include chown ([#​3143](seerr-team/seerr#3143)) - ([ebac489](seerr-team/seerr@ebac489)) - Add TrueNAS migration guidance ([#​3107](seerr-team/seerr#3107)) - ([8b062ed](seerr-team/seerr@8b062ed)) ##### ⚙️ Miscellaneous Tasks - *(actions)* Update github actions ([#​3041](seerr-team/seerr#3041)) - ([0438710](seerr-team/seerr@0438710)) - *(dev)* Add devenv setup ([#​3138](seerr-team/seerr#3138)) - ([d2ffe4f](seerr-team/seerr@d2ffe4f)) - *(i18n)* Update translations from Weblate - ([4b65ab5](seerr-team/seerr@4b65ab5)) - *(i18n)* Update translations from Weblate - ([1926095](seerr-team/seerr@1926095)) - *(i18n)* Update translations from Weblate - ([d051deb](seerr-team/seerr@d051deb)) - *(i18n)* Update translations from Weblate - ([8d351bc](seerr-team/seerr@8d351bc)) - *(i18n)* Update translations from Weblate - ([3f33842](seerr-team/seerr@3f33842)) - *(i18n)* Update translations from Weblate - ([6c8527f](seerr-team/seerr@6c8527f)) - *(i18n)* Update translations from Weblate - ([ab26f06](seerr-team/seerr@ab26f06)) - *(i18n)* Update translations from Weblate - ([0a305f6](seerr-team/seerr@0a305f6)) - *(i18n)* Update translations from Weblate - ([32249f2](seerr-team/seerr@32249f2)) - *(i18n)* Update translations from Weblate - ([2a249a8](seerr-team/seerr@2a249a8)) - *(release)* Prepare v3.4.0 - ([2dbe886](seerr-team/seerr@2dbe886)) - *(release)* Prepare 3.4.0 release - ([b21049a](seerr-team/seerr@b21049a)) ##### New Contributors ❤️ - [@​aaamoeder](https://github.com/aaamoeder) made their first contribution - [@​kouellette](https://github.com/kouellette) made their first contribution - [@​u61d](https://github.com/u61d) made their first contribution - [@​thraizz](https://github.com/thraizz) made their first contribution - [@​john-fletcher](https://github.com/john-fletcher) made their first contribution - [@​Gilmoursa](https://github.com/Gilmoursa) made their first contribution - [@​atoy3731](https://github.com/atoy3731) made their first contribution - [@​nightt5879](https://github.com/nightt5879) made their first contribution </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODMuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4My4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL21pbm9yIl19--> Reviewed-on: https://git.greyrock.io/greyrock-labs/home-ops/pulls/190
Description
When pages would build URLs for API requests, process.env.HOST would be directly concatenated with process.env.PORT (e.g.,
0.0.0.0:5055). This works for IPv4 address literals but does not work for IPv6 address literals because:::5055for example is invalid. This commit adds a check if process.env.HOST contains a colon (:) and if so, wraps the host in square brackets. E.g.,[::]:5055, which is valid. This allows for users to set the HOST environment variable to IPv6 address literals.How Has This Been Tested?
This was tested on a Debian 13 VM running kernel 6.12.48+deb13-amd64 for the server and a 13-inch 2022 MacBook Pro with the Arc browser Version 1.135.0 (75383), Chromium Engine Version 145.0.7632.110.
Tested by setting
HOSTenv var to::and another IPv6 literal and ensured pages loaded as expected and the error observed in the ticket was no longer occurring.Screenshots / Logs (if applicable)
Checklist:
pnpm buildpnpm i18n:extractSummary by CodeRabbit
Refactor
Chores
Chores