fix(core): avoid enumerating authorized IP subnets (#13851)

Use net.IPNet.Contains to check CIDR membership directly and remove the address increment loop. Large authorized subnets no longer cause per-request address enumeration and excessive CPU usage.

core/utils/common/common.go

@@ -204,26 +204,12 @@ func GetLang(c *gin.Context) string {
 }
 
 func CheckIpInCidr(cidr, checkIP string) bool {
-	ip, ipNet, err := net.ParseCIDR(cidr)
+	_, ipNet, err := net.ParseCIDR(cidr)
 	if err != nil {
 		global.LOG.Errorf("parse CIDR %s failed, err: %v", cidr, err)
 		return false
 	}
-	for ip := ip.Mask(ipNet.Mask); ipNet.Contains(ip); incIP(ip) {
-		if ip.String() == checkIP {
-			return true
-		}
-	}
-	return false
-}
-
-func incIP(ip net.IP) {
-	for j := len(ip) - 1; j >= 0; j-- {
-		ip[j]++
-		if ip[j] > 0 {
-			break
-		}
-	}
+	return ipNet.Contains(net.ParseIP(checkIP))
 }
 
 func HandleIPList(content string) ([]string, error) {