BUG: TrustedProxiesMiddleware truncates IPv6 addresses after first colon

[gradinarufelix]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Only the substring before the first colon is retained, producing 2a04.

Expected Behavior

The full IPv6 address (e.g. 2a04:f28:1:1234:5678:9abc:def0:1234) is preserved.

Steps To Reproduce

1. Deploy Flow with a trusted reverse-proxy setup.
2. Send an HTTP request from an IPv6 client (curl -H "X-Forwarded-For: 2a04:f28::1337" …).
3. Add additional logging to TrustedProxiesMiddleware
4. Check the middleware log: the address is truncated to 2a04.

Environment

- Flow: 8.3.14
- PHP: 8.3

Anything else?

The root cause appears to be this line, which naïvely splits on the first : assuming a port delimiter:

https://github.com/neos/flow/blob/137c9d44802e173fb18c79ef2037a0a74995bbe2/Classes/Http/Middleware/TrustedProxiesMiddleware.php#L277