CVE-2023-37265: CasaOS Gateway vulnerable to incorrect identification of source IP addresses

The vulnerability stemmed from improper IP validation in the request handling flow. The pre-patch code in gateway_route.go's GetRoute handler forwarded requests without sanitizing X-Forwarded-For headers. This allowed attackers to manipulate their perceived IP address to bypass authentication middleware (like ExceptLocalhost) that skipped JWT validation for localhost requests. The critical missing element was the rewriteRequestSourceIP() function added in the patch, which properly sanitizes headers and validates the remote IP before trusting X-Forwarded-For values. The anonymous handler function in GetRoute is identified as the vulnerable entry point because it directly handled incoming requests without these protections.