fix: filter out private addresses when only using dht (#68)

CHANGELOG.md

@@ -11,12 +11,6 @@ The following emojis are used to highlight certain changes:
 * 🛠 - BREAKING CHANGE.  Action is required if you use this functionality.
 * ✨ - Noteworthy change to be aware of.
 
-## [v0.2.1]
-
-### Fixed
-
-- Upgraded Boxo with fix to ensure that `/routing/v1/peers` endpoint accepts all variants of Peer IDs that are seen in the wild.
-
 ## [Unreleased]
 
 ### Added
@@ -27,4 +21,12 @@ The following emojis are used to highlight certain changes:
 
 ### Fixed
 
-### Security
+- The `/routing/v1/peers` endpoint correctly filters out private addresses.
+
+### Security
+
+## [v0.2.1]
+
+### Fixed
+
+- Upgraded Boxo with fix to ensure that `/routing/v1/peers` endpoint accepts all variants of Peer IDs that are seen in the wild.

server.go

@@ -155,7 +155,7 @@ func newHost(highOutboundLimits bool) (host.Host, error) {
 
 func getCombinedRouting(endpoints []string, dht routing.Routing) (router, error) {
 	if len(endpoints) == 0 {
-		return libp2pRouter{routing: dht}, nil
+		return sanitizeRouter{libp2pRouter{routing: dht}}, nil
 	}
 
 	var routers []router

server_test.go

@@ -0,0 +1,24 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetCombinedRouting(t *testing.T) {
+	t.Parallel()
+
+	// Check of the result of get combined routing is a sanitize router.
+	v, err := getCombinedRouting(nil, &bundledDHT{})
+	require.NoError(t, err)
+	require.IsType(t, sanitizeRouter{}, v)
+
+	v, err = getCombinedRouting([]string{"https://example.com/"}, nil)
+	require.NoError(t, err)
+	require.IsType(t, sanitizeRouter{}, v)
+
+	v, err = getCombinedRouting([]string{"https://example.com/"}, &bundledDHT{})
+	require.NoError(t, err)
+	require.IsType(t, sanitizeRouter{}, v)
+}