Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 4e4b216

Browse filesBrowse files
nicolas-grekasnicolas-grekas
committed
Merge branch '4.1'
* 4.1: [HttpKernel] fix forwarding trusted headers as server parameters
2 parents c099d86 + 3ac90c1 commit 4e4b216
Copy full SHA for 4e4b216

File tree

Expand file treeCollapse file tree

4 files changed

+22
-7
lines changed
Filter options
Expand file treeCollapse file tree

4 files changed

+22
-7
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Request.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2010,7 +2010,7 @@ private function normalizeAndFilterClientIps(array $clientIps, $ip)
20102010
if ($i) {
20112011
$clientIps[$key] = $clientIp = substr($clientIp, 0, $i);
20122012
}
2013-
} elseif ('[' == $clientIp[0]) {
2013+
} elseif (0 === strpos($clientIp, '[')) {
20142014
// Strip brackets and :port from IPv6 addresses.
20152015
$i = strpos($clientIp, ']', 1);
20162016
$clientIps[$key] = $clientIp = substr($clientIp, 1, $i - 1);

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -906,7 +906,7 @@ public function getClientIpsForwardedProvider()
906906

907907
public function getClientIpsProvider()
908908
{
909-
// $expected $remoteAddr $httpForwardedFor $trustedProxies
909+
// $expected $remoteAddr $httpForwardedFor $trustedProxies
910910
return array(
911911
// simple IPv4
912912
array(array('88.88.88.88'), '88.88.88.88', null, null),
@@ -920,8 +920,8 @@ public function getClientIpsProvider()
920920

921921
// forwarded for with remote IPv4 addr not trusted
922922
array(array('127.0.0.1'), '127.0.0.1', '88.88.88.88', null),
923-
// forwarded for with remote IPv4 addr trusted
924-
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1')),
923+
// forwarded for with remote IPv4 addr trusted + comma
924+
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88,', array('127.0.0.1')),
925925
// forwarded for with remote IPv4 and all FF addrs trusted
926926
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1', '88.88.88.88')),
927927
// forwarded for with remote IPv4 range trusted

‎src/Symfony/Component/HttpKernel/HttpCache/SubRequestHandler.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpKernel/HttpCache/SubRequestHandler.php
+7-3Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ public static function handle(HttpKernelInterface $kernel, Request $request, $ty
4141
);
4242
foreach (array_filter($trustedHeaders) as $name => $key) {
4343
$request->headers->remove($name);
44+
$request->server->remove('HTTP_'.$name);
4445
}
4546
}
4647

@@ -59,13 +60,16 @@ public static function handle(HttpKernelInterface $kernel, Request $request, $ty
5960
// set trusted values, reusing as much as possible the global trusted settings
6061
if (Request::HEADER_FORWARDED & $trustedHeaderSet) {
6162
$trustedValues[0] .= sprintf(';host="%s";proto=%s', $request->getHttpHost(), $request->getScheme());
62-
$request->headers->set('Forwarded', implode(', ', $trustedValues));
63+
$request->headers->set('Forwarded', $v = implode(', ', $trustedValues));
64+
$request->server->set('HTTP_FORWARDED', $v);
6365
}
6466
if (Request::HEADER_X_FORWARDED_FOR & $trustedHeaderSet) {
65-
$request->headers->set('X-Forwarded-For', implode(', ', $trustedIps));
67+
$request->headers->set('X-Forwarded-For', $v = implode(', ', $trustedIps));
68+
$request->server->set('HTTP_X_FORWARDED_FOR', $v);
6669
} elseif (!(Request::HEADER_FORWARDED & $trustedHeaderSet)) {
6770
Request::setTrustedProxies($trustedProxies, $trustedHeaderSet | Request::HEADER_X_FORWARDED_FOR);
68-
$request->headers->set('X-Forwarded-For', implode(', ', $trustedIps));
71+
$request->headers->set('X-Forwarded-For', $v = implode(', ', $trustedIps));
72+
$request->server->set('HTTP_X_FORWARDED_FOR', $v);
6973
}
7074

7175
// fix the client IP address by setting it to 127.0.0.1,

‎src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,8 @@ public function testRenderWithObjectsAsAttributes()
4545
$subRequest->attributes->replace(array('object' => $object, '_format' => 'html', '_controller' => 'main_controller', '_locale' => 'en'));
4646
$subRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
4747
$subRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
48+
$subRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
49+
$subRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
4850

4951
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($subRequest));
5052

@@ -57,6 +59,7 @@ public function testRenderWithTrustedHeaderDisabled()
5759

5860
$expectedSubRequest = Request::create('/');
5961
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
62+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
6063

6164
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
6265
$this->assertSame('foo', $strategy->render('/', Request::create('/'))->getContent());
@@ -149,8 +152,10 @@ public function testESIHeaderIsKeptInSubrequest()
149152

150153
if (Request::HEADER_X_FORWARDED_FOR & Request::getTrustedHeaderSet()) {
151154
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
155+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
152156
}
153157
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
158+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
154159

155160
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
156161

@@ -173,6 +178,8 @@ public function testHeadersPossiblyResultingIn304AreNotAssignedToSubrequest()
173178
$expectedSubRequest = Request::create('/');
174179
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
175180
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
181+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
182+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
176183

177184
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
178185
$request = Request::create('/', 'GET', array(), array(), array(), array('HTTP_IF_MODIFIED_SINCE' => 'Fri, 01 Jan 2016 00:00:00 GMT', 'HTTP_IF_NONE_MATCH' => '*'));
@@ -188,6 +195,8 @@ public function testFirstTrustedProxyIsSetAsRemote()
188195
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
189196
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
190197
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
198+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
199+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
191200

192201
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
193202

@@ -205,6 +214,8 @@ public function testIpAddressOfRangedTrustedProxyIsSetAsRemote()
205214
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
206215
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
207216
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
217+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
218+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
208219

209220
Request::setTrustedProxies(array('1.1.1.1/24'), -1);
210221

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.