From b03144d1a350346a548ea840f141869d68bd672a Mon Sep 17 00:00:00 2001
From: Matt Baker <mbaker@shipt.com>
Date: Fri, 1 Nov 2019 14:49:24 -0500
Subject: [PATCH] validating IPv4 from XFwdFor field

---
 internal/logprocessor/logprocessor.go | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/internal/logprocessor/logprocessor.go b/internal/logprocessor/logprocessor.go
index 376cbb0..dc7f026 100644
--- a/internal/logprocessor/logprocessor.go
+++ b/internal/logprocessor/logprocessor.go
@@ -2,6 +2,7 @@ package logprocessor
 
 import (
 	"encoding/json"
+	"net"
 
 	"github.com/shipt/specter/internal/ttlcache"
 
@@ -59,12 +60,10 @@ func (c *Client) parseResponse(body []byte) ([]byte, error) {
 	}
 
 	conn := connection{}
-	conn.XFwdFor = rb.XFwdFor
-	if conn.XFwdFor != "" {
-		if conn.XFwdFor != "-" {
-			conn.SrcIP = rb.XFwdFor
-		}
-	} else {
+
+	conn.SrcIP = rb.XFwdFor
+	validIP := net.ParseIP(rb.XFwdFor)
+	if validIP.To4() == nil {
 		conn.SrcIP = rb.SrcIP
 	}