From e272caa3859f12957246693132cefb94c3f31445 Mon Sep 17 00:00:00 2001
From: Richard Hansen <rhansen@rhansen.org>
Date: Mon, 22 Jul 2024 21:03:25 -0400
Subject: [PATCH] use=web, use=<fw>: Strip HTTP headers before searching for IP

---
 ChangeLog.md | 4 ++++
 ddclient.in  | 6 ++++++
 t/use_web.pl | 6 +++++-
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/ChangeLog.md b/ChangeLog.md
index 78f4e3a..6a64b47 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -131,6 +131,10 @@ repository history](https://github.com/ddclient/ddclient/commits/master).
     [#713](https://github.com/ddclient/ddclient/pull/713)
   * `easydns`: Fixed successful updates treated as failed updates.
     [#713](https://github.com/ddclient/ddclient/pull/713)
+  * Any IP addresses in an HTTP response's headers are now ignored when
+    obtaining the IP address from a web-based IP discovery service
+    (`--usev4=webv4`, `--usev6=webv6`) or from a router/firewall device.
+    [#719](https://github.com/ddclient/ddclient/pull/719)
 
 ## 2023-11-23 v3.11.2
 
diff --git a/ddclient.in b/ddclient.in
index 61beb78..184ccee 100755
--- a/ddclient.in
+++ b/ddclient.in
@@ -222,6 +222,7 @@ sub query_cisco {
         ignore_ssl_option => 1,
         ssl_validate => opt('fw-ssl-validate', $h),
     ) // '';
+    $reply =~ s/^.*?\n\n//s;
     return $reply;
 }
 
@@ -2788,6 +2789,7 @@ sub get_ip {
                 url => $url,
                 ssl_validate => opt('web-ssl-validate', $h),
             ) // '';
+            $reply =~ s/^.*?\n\n//s;
         }
     } elsif ($use eq 'disabled') {
         ## This is a no-op... Do not get an IP address for this host/service
@@ -2814,6 +2816,7 @@ sub get_ip {
                 ignore_ssl_option => 1,
                 ssl_validate => opt('fw-ssl-validate', $h),
             ) // '';
+            $reply =~ s/^.*?\n\n//s;
         }
     } else {
         warning("ignoring unsupported '--use' strategy: $use");
@@ -3181,6 +3184,7 @@ sub get_ipv4 {
                 ipversion => 4, # when using a URL to find IPv4 address we should force use of IPv4
                 ssl_validate => opt('web-ssl-validate', $h),
             ) // '';
+            $reply =~ s/^.*?\n\n//s;
         }
     } elsif ($usev4 eq 'disabled') {
         ## This is a no-op... Do not get an IPv4 address for this host/service
@@ -3212,6 +3216,7 @@ sub get_ipv4 {
                 ignore_ssl_option => 1,
                 ssl_validate => opt('fw-ssl-validate', $h),
             ) // '';
+            $reply =~ s/^.*?\n\n//s;
         }
     } else {
         warning("ignoring unsupported '--usev4' strategy: $usev4");
@@ -3289,6 +3294,7 @@ sub get_ipv6 {
                 ipversion => 6, # when using a URL to find IPv6 address we should force use of IPv6
                 ssl_validate => opt('web-ssl-validate', $h),
             ) // '';
+            $reply =~ s/^.*?\n\n//s;
         }
     } elsif ($usev6 eq 'disabled') {
         $reply = '';
diff --git a/t/use_web.pl b/t/use_web.pl
index 82ff3a5..e9a9771 100644
--- a/t/use_web.pl
+++ b/t/use_web.pl
@@ -27,7 +27,11 @@ sub run_httpd {
         host => $ipv eq '4' ? '127.0.0.1' : '::1',
         daemon_args => {V6Only => 1},
     );
-    my $headers = ['content-type' => 'text/plain'];
+    my $headers = [
+        'content-type' => 'text/plain',
+        'this-ipv4-should-be-ignored' => 'skip skip2 192.0.2.255',
+        'this-ipv6-should-be-ignored' => 'skip skip2 2001:db8::ff',
+    ];
     my $content = $ipv eq '4'
         ? '192.0.2.1 skip 192.0.2.2 skip2 192.0.2.3'
         : '2001:db8::1 skip 2001:db8::2 skip2 2001:db8::3';