{"record":{"id":"cd50d251ca22e2ed","repo":"MagicMirrorOrg/MagicMirror","slug":"invalid-whitelist-entry-entry","errorCode":null,"errorMessage":"Invalid whitelist entry: ${entry}","messagePattern":"Invalid whitelist entry: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"js/ip_access_control.js","lineNumber":26,"sourceCode":" * @returns {boolean} True if IP is allowed\n */\nfunction isAllowed (clientIp, whitelist) {\n\ttry {\n\t\tconst addr = ipaddr.process(clientIp);\n\n\t\treturn whitelist.some((entry) => {\n\t\t\ttry {\n\t\t\t\t// CIDR notation\n\t\t\t\tif (entry.includes(\"/\")) {\n\t\t\t\t\tconst [rangeAddr, prefixLen] = ipaddr.parseCIDR(entry);\n\t\t\t\t\treturn addr.match(rangeAddr, prefixLen);\n\t\t\t\t}\n\n\t\t\t\t// Single IP address - let ipaddr.process normalize both\n\t\t\t\tconst allowedAddr = ipaddr.process(entry);\n\t\t\t\treturn addr.toString() === allowedAddr.toString();\n\t\t\t} catch {\n\t\t\t\tLog.warn(`Invalid whitelist entry: ${entry}`);\n\t\t\t\treturn false;\n\t\t\t}\n\t\t});\n\t} catch {\n\t\tLog.warn(`Failed to parse client IP: ${clientIp}`);\n\t\treturn false;\n\t}\n}\n\n/**\n * Resolves a client IP for both Express and Socket.IO requests.\n * If the direct peer is loopback, trust the first X-Forwarded-For value (local reverse proxy case).\n * Otherwise ignore X-Forwarded-For to prevent spoofing.\n * @param {object} req - Incoming request object (Express request or Socket.IO handshake request)\n * @returns {string} The resolved client IP address\n */\nfunction resolveClientIp (req) {\n\tconst directIp = req.socket?.remoteAddress || req.connection?.remoteAddress || req.ip;","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/MagicMirrorOrg/MagicMirror/blob/4b4a59534f7da01e4030e46029fe9dd649a7675e/js/ip_access_control.js#L8-L44","documentation":"In isAllowed, each whitelist entry is parsed with ipaddr.process and compared against the client IP. If an entry cannot be parsed as a valid IP address or CIDR range, the entry throws, is caught, logged as this warning, and the entry is treated as not matching (returns false for that entry).","triggerScenarios":"ipAccessControl whitelist (or server config ipWhitelist) contains a malformed entry — e.g. '192.168.1.*' wildcards, hostnames, 'localhost', or a typo like '192.168.1.300' — that ipaddr.process cannot parse.","commonSituations":"Users copying old wildcard-style whitelist entries ('::ffff:127.0.0.1' is fine but '127.0.0.*' is not); using DNS names instead of IPs; leftover commas or whitespace artifacts from editing.","solutions":["Replace the invalid entry with a valid IP or CIDR range: e.g. \"127.0.0.1\", \"::1\", \"192.168.1.0/24\".","Test the entry with ipaddr.js first: ipaddr.process('192.168.1.0/24') in a node REPL.","Use ipWhitelist: [] to allow all clients if you intend no restriction.","Remove leftover wildcard '*' entries — CIDR notation is the supported way to allow ranges."],"exampleFix":"// before (config.js)\nipWhitelist: [\"127.0.0.1\", \"192.168.1.*\"]\n// after\nipWhitelist: [\"127.0.0.1\", \"::1\", \"192.168.1.0/24\"]","handlingStrategy":"validation","validationCode":"const ipaddr = require(\"ipaddr.js\");\nfunction validateWhitelist(list) {\n  list.forEach(entry => {\n    try { ipaddr.process(entry); }\n    catch { throw new Error(`Invalid whitelist entry: ${entry}`); }\n  });\n}\n// call at startup: validateWhitelist(config.ipWhitelist)","typeGuard":"function isParsableAddress(entry) {\n  try { ipaddr.process(entry); return true; }\n  catch { return false; }\n}","tryCatchPattern":"try {\n  const allowed = ipaddr.process(entry);\n  return clientAddr.toString() === allowed.toString();\n} catch {\n  Log.warn(`Skipping invalid whitelist entry: ${entry}`);\n  return false;\n}","preventionTips":["Use only IPs or CIDR ranges in ipWhitelist — never wildcards or hostnames.","Run every entry through ipaddr.js at startup to fail fast with a clear message.","Copy entries from working examples (e.g. \"127.0.0.1\", \"::1\", \"192.168.1.0/24\")."],"tags":["ip","whitelist","validation","security"],"backgroundTag":"invalid-ip-whitelist-entry","analyzedSha":"4b4a59534f7da01e4030e46029fe9dd649a7675e","analyzedAt":"2026-08-31T21:49:42.591Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}