From 3814525edd4b2164c952282069e2007010f93225 Mon Sep 17 00:00:00 2001
From: ssongliu <sloooop1x@gmail.com>
Date: Thu, 17 Sep 2026 15:45:57 +0800
Subject: [PATCH] fix(core): avoid enumerating authorized IP subnets (#13851)

Use net.IPNet.Contains to check CIDR membership directly and remove the address increment loop. Large authorized subnets no longer cause per-request address enumeration and excessive CPU usage.
---
 core/utils/common/common.go | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/core/utils/common/common.go b/core/utils/common/common.go
index 8f3a254b8..ce199b4a4 100644
--- a/core/utils/common/common.go
+++ b/core/utils/common/common.go
@@ -204,26 +204,12 @@ func GetLang(c *gin.Context) string {
 }
 
 func CheckIpInCidr(cidr, checkIP string) bool {
-	ip, ipNet, err := net.ParseCIDR(cidr)
+	_, ipNet, err := net.ParseCIDR(cidr)
 	if err != nil {
 		global.LOG.Errorf("parse CIDR %s failed, err: %v", cidr, err)
 		return false
 	}
-	for ip := ip.Mask(ipNet.Mask); ipNet.Contains(ip); incIP(ip) {
-		if ip.String() == checkIP {
-			return true
-		}
-	}
-	return false
-}
-
-func incIP(ip net.IP) {
-	for j := len(ip) - 1; j >= 0; j-- {
-		ip[j]++
-		if ip[j] > 0 {
-			break
-		}
-	}
+	return ipNet.Contains(net.ParseIP(checkIP))
 }
 
 func HandleIPList(content string) ([]string, error) {