When the "trusted_proxies" option is configured, heimdall extracts client IP addresses from the "Forwarded" ("for=" parameter) and "X-Forwarded-For" headers and exposes them as "Request.ClientIPAddresses" to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 "unknown" values and obfuscated identifiers are accepted without further checks. In addition, the "Forwarded" header parser splits on "," and ";" without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses.