If Spigot is running without a proxy, an incoming BungeeCord can also originate from a malicious player. This happens, because there is no proxy preventing this message. There appears to be no method to check if this message comes from a trusted source from the Bukkit side.
This implementation checks if BungeeCord support is enabled in Spigot. This means that we notify them that we actually expect a proxy enabled configuration for this feature. This solves the issue, where the hook was enabled, because the server was earlier configured with proxies in mind, but they are no longer used.
**Nevertheless** this doesn't fully solve the issue, because in misconfigured setups, where the Spigot server is publicly accessible, it's still possible. However this is always a recommended configuration step.
Alternative solutions were rejected like:
1) Check on incoming BungeeCord message, if we received BungeeCord forwarding data during login
This data can be fully faked by the player too.
2) Check the connection properties if the appearing proxy is local.
While this is possible, there instance that the proxy is not on the same network although it's legitimate. Although it could be possible to introduce this with a configuration option, but it would increase the complexity for users.
Related #2559
Related #2571
* Add IPv6 support for isLocal checks
* Replace magic values like 127.0.0.1 and use our utility
* Support for IPv6 local adresses in IPv6 only or dual stack environments
* Loopback [::1]
* Site-Local fc00::/7
* Link-local fe80::/10
* Introduce extra method for loopback addresses
* Use public IP for passMaxLogin check
* Use non-local IP addresses in test after change in verification
* Migrate to GEO IP 2, because support will drop in April
* Change all links of maxmind to https
* Update maxmind database dependency and add javatar to extract
the database from the tar archive
(now only a small difference in jar file size -> ~80KB smaller)
* Verify downloaded archive using MD5 (There are no other checksums available)
* Migrate to Java NIO instead of old java file I/O (Feedback?)
* Internal Optional usage for nullable values (Feedback?)
Minor:
* Schedule a Bukkit async task instead of creating a thread manually
* Validate ip input string
* Extract validation into single method
* Close all resources safely using try-resources
* More https links
* Add documentation
* Set the same last modification as in the tar archive
* Fix tests
* Comment how the legacy API responded to unknown entries
* Document missing function param
* Document our maxmind dependency modifications
* Include time unit into constant
* More logging for downloading the database
* Add missing return if the database cannot be found
* Delete temporarily file after working with it
* Replace DatatypeConverter in Pbkdf2Django to support Java 9
* Fix NPE in AuthMeInitializer and CastException in Recovery tests
* Set logger for SetPasswordTest to prevent NPE on logging
* Use TestHelper for initializing ConsoleLogger
