Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 072fe39

Browse filesBrowse files
nicolas-grekasnicolas-grekas
committed
[HttpFoundation] Add $trustedHeaderSet arg to Request::setTrustedProxies() - deprecate not setting it
1 parent aaa1437 commit 072fe39
Copy full SHA for 072fe39

File tree

Expand file treeCollapse file tree

21 files changed

+238
-61
lines changed
Filter options
Expand file treeCollapse file tree

21 files changed

+238
-61
lines changed

‎UPGRADE-3.3.md

Copy file name to clipboardExpand all lines: UPGRADE-3.3.md
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ Finder
117117
FrameworkBundle
118118
---------------
119119

120+
* The "framework.trusted_proxies configuration option and the corresponding "kernel.trusted_proxies" parameter have been deprecated and will be removed in 4.0. Use the Request::setTrustedProxies() method in your front controller instead.
121+
120122
* The `Symfony\Bundle\FrameworkBundle\DependencyInjection\Compiler\AddConsoleCommandPass` has been deprecated. Use `Symfony\Component\Console\DependencyInjection\AddConsoleCommandPass` instead.
121123

122124
* The `Symfony\Bundle\FrameworkBundle\DependencyInjection\Compiler\SerializerPass` class has been
@@ -166,6 +168,16 @@ FrameworkBundle
166168
class has been deprecated and will be removed in 4.0. Use the
167169
`Symfony\Component\Routing\DependencyInjection\RoutingResolverPass` class instead.
168170

171+
HttpFoundation
172+
--------------
173+
174+
* The `Request::setTrustedProxies()` method takes a new `$trustedHeaderSet` argument - not setting it is deprecated.
175+
Set it to `Request::HEADER_FORWARDED` if your reverse-proxy uses the RFC7239 `Forwarded` header,
176+
or to `Request::HEADER_X_FORWARDED_ALL` if it is using `X-Forwarded-*` headers instead.
177+
178+
* The `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods are deprecated,
179+
use the RFC7239 `Forwarded` header, or the `X-Forwarded-*` headers instead.
180+
169181
HttpKernel
170182
-----------
171183

‎UPGRADE-4.0.md

Copy file name to clipboardExpand all lines: UPGRADE-4.0.md
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,8 @@ Form
187187
FrameworkBundle
188188
---------------
189189

190+
* The "framework.trusted_proxies" configuration option and the corresponding "kernel.trusted_proxies" parameter have been removed. Use the `Request::setTrustedProxies()` method in your front controller instead.
191+
190192
* Support for absolute template paths has been removed.
191193

192194
* The following form types registered as services have been removed; use their
@@ -274,6 +276,15 @@ FrameworkBundle
274276
HttpFoundation
275277
---------------
276278

279+
HttpFoundation
280+
--------------
281+
282+
* The `Request::setTrustedProxies()` method takes a new `$trustedHeaderSet` argument.
283+
Set it to `Request::HEADER_FORWARDED` if your reverse-proxy uses the RFC7239 `Forwarded` header,
284+
or to `Request::HEADER_X_FORWARDED_ALL` if it is using `X-Forwarded-*` headers instead.
285+
286+
* The `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods have been removed.
287+
277288
* Extending the following methods of `Response`
278289
is no longer possible (these methods are now `final`):
279290

‎src/Symfony/Bridge/Monolog/Tests/Processor/WebProcessorTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bridge/Monolog/Tests/Processor/WebProcessorTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ public function testUsesRequestServerData()
3636

3737
public function testUseRequestClientIp()
3838
{
39-
Request::setTrustedProxies(array('192.168.0.1'));
39+
Request::setTrustedProxies(array('192.168.0.1'), Request::HEADER_X_FORWARDED_ALL);
4040
list($event, $server) = $this->createRequestEvent(array('X_FORWARDED_FOR' => '192.168.0.2'));
4141

4242
$processor = new WebProcessor();

‎src/Symfony/Bridge/Monolog/composer.json

Copy file name to clipboardExpand all lines: src/Symfony/Bridge/Monolog/composer.json
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
"symfony/event-dispatcher": "~2.8|~3.0",
2626
"symfony/var-dumper": "~3.3"
2727
},
28+
"conflict": {
29+
"symfony/http-foundation": "<3.3"
30+
},
2831
"suggest": {
2932
"symfony/http-kernel": "For using the debugging handlers together with the response life cycle of the HTTP kernel.",
3033
"symfony/console": "For the possibility to show log messages in console commands depending on verbosity settings. You need version ~2.3 of the console for it.",

‎src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ CHANGELOG
44
3.3.0
55
-----
66

7+
* Deprecated the "framework.trusted_proxies" configuration option and the corresponding "kernel.trusted_proxies" parameter
78
* Changed default configuration for
89
assets/forms/validation/translation/serialization/csrf from `canBeEnabled()` to
910
`canBeDisabled()` when Flex is used

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
+9Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Config\Definition\Builder\TreeBuilder;
1919
use Symfony\Component\Config\Definition\ConfigurationInterface;
2020
use Symfony\Component\Form\Form;
21+
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\Serializer\Serializer;
2223
use Symfony\Component\Translation\Translator;
2324
use Symfony\Component\Validator\Validation;
@@ -58,6 +59,14 @@ public function getConfigTreeBuilder()
5859
return $v;
5960
})
6061
->end()
62+
->beforeNormalization()
63+
->ifTrue(function ($v) { return isset($v['trusted_proxies']); })
64+
->then(function ($v) {
65+
@trigger_error('The "framework.trusted_proxies" configuration key is deprecated since version 3.3 and will be removed in 4.0. Use the Request::setTrustedProxies() method in your front controller instead.', E_USER_DEPRECATED);
66+
67+
return $v;
68+
})
69+
->end()
6170
->children()
6271
->scalarNode('secret')->end()
6372
->scalarNode('http_method_override')

‎src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php
+3-1Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,9 @@ public function boot()
6060
ErrorHandler::register(null, false)->throwAt($this->container->getParameter('debug.error_handler.throw_at'), true);
6161

6262
if ($trustedProxies = $this->container->getParameter('kernel.trusted_proxies')) {
63-
Request::setTrustedProxies($trustedProxies);
63+
@trigger_error('The "kernel.trusted_proxies" parameter is deprecated since version 3.3 and will be removed in 4.0. Use the Request::setTrustedProxies() method in your front controller instead.', E_USER_DEPRECATED);
64+
65+
Request::setTrustedProxies($trustedProxies, Request::getTrustedHeaderSet());
6466
}
6567

6668
if ($this->container->getParameter('kernel.http_method_override')) {

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ public function testDoNoDuplicateDefaultFormResources()
4343
}
4444

4545
/**
46+
* @group legacy
4647
* @dataProvider getTestValidTrustedProxiesData
4748
*/
4849
public function testValidTrustedProxies($trustedProxies, $processedProxies)
@@ -73,6 +74,7 @@ public function getTestValidTrustedProxiesData()
7374
}
7475

7576
/**
77+
* @group legacy
7678
* @expectedException \Symfony\Component\Config\Definition\Exception\InvalidConfigurationException
7779
*/
7880
public function testInvalidTypeTrustedProxies()
@@ -88,6 +90,7 @@ public function testInvalidTypeTrustedProxies()
8890
}
8991

9092
/**
93+
* @group legacy
9194
* @expectedException \Symfony\Component\Config\Definition\Exception\InvalidConfigurationException
9295
*/
9396
public function testInvalidValueTrustedProxies()

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
),
1111
),
1212
'http_method_override' => false,
13-
'trusted_proxies' => array('127.0.0.1', '10.0.0.1'),
1413
'esi' => array(
1514
'enabled' => true,
1615
),

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
77
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
88

9-
<framework:config secret="s3cr3t" ide="file%%link%%format" default-locale="fr" trusted-proxies="127.0.0.1, 10.0.0.1" http-method-override="false">
9+
<framework:config secret="s3cr3t" ide="file%%link%%format" default-locale="fr" http-method-override="false">
1010
<framework:csrf-protection />
1111
<framework:form>
1212
<framework:csrf-protection field-name="_csrf"/>

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/full.yml

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/full.yml
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ framework:
66
csrf_protection:
77
field_name: _csrf
88
http_method_override: false
9-
trusted_proxies: ['127.0.0.1', '10.0.0.1']
109
esi:
1110
enabled: true
1211
profiler:

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
-7Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -86,13 +86,6 @@ public function testCsrfProtectionForFormsEnablesCsrfProtectionAutomatically()
8686
$this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
8787
}
8888

89-
public function testProxies()
90-
{
91-
$container = $this->createContainerFromFile('full');
92-
93-
$this->assertEquals(array('127.0.0.1', '10.0.0.1'), $container->getParameter('kernel.trusted_proxies'));
94-
}
95-
9689
public function testHttpMethodOverride()
9790
{
9891
$container = $this->createContainerFromFile('full');

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/CHANGELOG.md
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ CHANGELOG
44
3.3.0
55
-----
66

7+
* added `$trustedHeaderSet` argument to `Request::setTrustedProxies()` - deprecate not setting it,
8+
* deprecated the `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods,
79
* added `File\Stream`, to be passed to `BinaryFileResponse` when the size of the served file is unknown,
810
disabling `Range` and `Content-Length` handling, switching to chunked encoding instead
911
* added the `Cookie::fromString()` method that allows to create a cookie from a

‎src/Symfony/Component/HttpFoundation/Request.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Request.php
+69-7Lines changed: 69 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,21 @@
3030
*/
3131
class Request
3232
{
33-
const HEADER_FORWARDED = 'forwarded';
34-
const HEADER_CLIENT_IP = 'client_ip';
35-
const HEADER_CLIENT_HOST = 'client_host';
36-
const HEADER_CLIENT_PROTO = 'client_proto';
37-
const HEADER_CLIENT_PORT = 'client_port';
33+
const HEADER_FORWARDED = 0b00001;
34+
const HEADER_X_FORWARDED_ALL = 0b11110;
35+
const HEADER_X_FORWARDED_FOR = 2;
36+
const HEADER_X_FORWARDED_HOST = 4;
37+
const HEADER_X_FORWARDED_PROTO = 8;
38+
const HEADER_X_FORWARDED_PORT = 16;
39+
40+
/** @deprecated since version 3.3, to be removed in 4.0 */
41+
const HEADER_CLIENT_IP = self::HEADER_X_FORWARDED_FOR;
42+
/** @deprecated since version 3.3, to be removed in 4.0 */
43+
const HEADER_CLIENT_HOST = self::HEADER_X_FORWARDED_HOST;
44+
/** @deprecated since version 3.3, to be removed in 4.0 */
45+
const HEADER_CLIENT_PROTO = self::HEADER_X_FORWARDED_PROTO;
46+
/** @deprecated since version 3.3, to be removed in 4.0 */
47+
const HEADER_CLIENT_PORT = self::HEADER_X_FORWARDED_PORT;
3848

3949
const METHOD_HEAD = 'HEAD';
4050
const METHOD_GET = 'GET';
@@ -70,6 +80,8 @@ class Request
7080
*
7181
* The other headers are non-standard, but widely used
7282
* by popular reverse proxies (like Apache mod_proxy or Amazon EC2).
83+
*
84+
* @deprecated since version 3.3, to be removed in 4.0
7385
*/
7486
protected static $trustedHeaders = array(
7587
self::HEADER_FORWARDED => 'FORWARDED',
@@ -210,6 +222,17 @@ class Request
210222
private $isHostValid = true;
211223
private $isClientIpsValid = true;
212224

225+
private static $trustedHeaderSet = -1;
226+
227+
/** @deprecated since version 3.3, to be removed in 4.0 */
228+
private static $trustedHeaderNames = array(
229+
self::HEADER_FORWARDED => 'FORWARDED',
230+
self::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',
231+
self::HEADER_CLIENT_HOST => 'X_FORWARDED_HOST',
232+
self::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',
233+
self::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',
234+
);
235+
213236
/**
214237
* Constructor.
215238
*
@@ -548,11 +571,26 @@ public function overrideGlobals()
548571
*
549572
* You should only list the reverse proxies that you manage directly.
550573
*
551-
* @param array $proxies A list of trusted proxies
574+
* @param array $proxies A list of trusted proxies
575+
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, usually either Request::HEADER_FORWARDED or Request::HEADER_X_FORWARDED_ALL, to set which headers to trust from your proxies
576+
*
577+
* @throws \InvalidArgumentException When $trustedHeaderSet is invalid
552578
*/
553-
public static function setTrustedProxies(array $proxies)
579+
public static function setTrustedProxies(array $proxies/*, int $trustedHeaderSet*/)
554580
{
555581
self::$trustedProxies = $proxies;
582+
583+
if (2 > func_num_args()) {
584+
@trigger_error(sprintf('The %s() method expects a bit field of Request::HEADER_* as second argument. Not defining it is deprecated since version 3.3 and will be required in 4.0.', __METHOD__), E_USER_DEPRECATED);
585+
586+
return;
587+
}
588+
$trustedHeaderSet = func_get_arg(1);
589+
590+
foreach (self::$trustedHeaderNames as $header => $name) {
591+
self::$trustedHeaders[$header] = $header & $trustedHeaderSet ? $name : null;
592+
}
593+
self::$trustedHeaderSet = $trustedHeaderSet;
556594
}
557595

558596
/**
@@ -565,6 +603,16 @@ public static function getTrustedProxies()
565603
return self::$trustedProxies;
566604
}
567605

606+
/**
607+
* Gets the set of trusted headers from trusted proxies.
608+
*
609+
* @return int A bit field of Request::HEADER_* that defines which headers are trusted from your proxies
610+
*/
611+
public static function getTrustedHeaderSet()
612+
{
613+
return self::$trustedHeaderSet;
614+
}
615+
568616
/**
569617
* Sets a list of trusted host patterns.
570618
*
@@ -608,14 +656,22 @@ public static function getTrustedHosts()
608656
* @param string $value The header name
609657
*
610658
* @throws \InvalidArgumentException
659+
*
660+
* @deprecated since version 3.3, to be removed in 4.0. Use "X-Forwarded-*" headers or the "Forwarded" header defined in RFC7239, and the $trustedHeaderSet argument of the Request::setTrustedProxies() method instead.
611661
*/
612662
public static function setTrustedHeaderName($key, $value)
613663
{
664+
@trigger_error(sprintf('The "%s()" method is deprecated since version 3.3 and will be removed in 4.0. Use "X-Forwarded-*" headers or the "Forwarded" header defined in RFC7239, and the $trustedHeaderSet argument of the Request::setTrustedProxies() method instead.', __METHOD__), E_USER_DEPRECATED);
665+
614666
if (!array_key_exists($key, self::$trustedHeaders)) {
615667
throw new \InvalidArgumentException(sprintf('Unable to set the trusted header name for key "%s".', $key));
616668
}
617669

618670
self::$trustedHeaders[$key] = $value;
671+
672+
if (null !== $value) {
673+
self::$trustedHeaderNames[$key] = $value;
674+
}
619675
}
620676

621677
/**
@@ -626,9 +682,15 @@ public static function setTrustedHeaderName($key, $value)
626682
* @return string The header name
627683
*
628684
* @throws \InvalidArgumentException
685+
*
686+
* @deprecated since version 3.3, to be removed in 4.0. Use the Request::getTrustedHeaderSet() method instead.
629687
*/
630688
public static function getTrustedHeaderName($key)
631689
{
690+
if (2 > func_num_args() || func_get_arg(1)) {
691+
@trigger_error(sprintf('The "%s()" method is deprecated since version 3.3 and will be removed in 4.0. Use the Request::getTrustedHeaderSet() method instead.', __METHOD__), E_USER_DEPRECATED);
692+
}
693+
632694
if (!array_key_exists($key, self::$trustedHeaders)) {
633695
throw new \InvalidArgumentException(sprintf('Unable to get the trusted header name for key "%s".', $key));
634696
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.