#java

2pages tagged with "java"

infosec

ip access control vs x-forwarded-for: two java footguns— jetty's InetAccessHandler and undertow's ProxyPeerAddressHandler both let an ip allow-list be driven by the client-supplied X-Forwarded-For header in their documented reverse-proxy setups. the interactions are public and arguably intentional; the real defects are a false jetty javadoc guarantee and a misleading undertow method name, not new bypasses.

security

minecraft chunk-batch backpressure bypass (MC-308703)— a client-controlled acknowledgement counter in the java-edition server had no lower bound, letting a joined player defeat chunk-send flow control and drive the server into unbounded off-heap growth and tick stall. reported as mojira MC-308703, fixed silently in 26.2.