Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 96e0833

Browse filesBrowse files
nicolas-grekasnicolas-grekas
committed
Merge branch '2.8' into 3.4
* 2.8: [HttpKernel] fix forwarding trusted headers as server parameters
2 parents 24e8bc2 + 2554ad0 commit 96e0833
Copy full SHA for 96e0833

File tree

Expand file treeCollapse file tree

4 files changed

+22
-7
lines changed
Filter options
Expand file treeCollapse file tree

4 files changed

+22
-7
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Request.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2134,7 +2134,7 @@ private function normalizeAndFilterClientIps(array $clientIps, $ip)
21342134
if ($i) {
21352135
$clientIps[$key] = $clientIp = substr($clientIp, 0, $i);
21362136
}
2137-
} elseif ('[' == $clientIp[0]) {
2137+
} elseif (0 === strpos($clientIp, '[')) {
21382138
// Strip brackets and :port from IPv6 addresses.
21392139
$i = strpos($clientIp, ']', 1);
21402140
$clientIps[$key] = $clientIp = substr($clientIp, 1, $i - 1);

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -900,7 +900,7 @@ public function getClientIpsForwardedProvider()
900900

901901
public function getClientIpsProvider()
902902
{
903-
// $expected $remoteAddr $httpForwardedFor $trustedProxies
903+
// $expected $remoteAddr $httpForwardedFor $trustedProxies
904904
return array(
905905
// simple IPv4
906906
array(array('88.88.88.88'), '88.88.88.88', null, null),
@@ -914,8 +914,8 @@ public function getClientIpsProvider()
914914

915915
// forwarded for with remote IPv4 addr not trusted
916916
array(array('127.0.0.1'), '127.0.0.1', '88.88.88.88', null),
917-
// forwarded for with remote IPv4 addr trusted
918-
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1')),
917+
// forwarded for with remote IPv4 addr trusted + comma
918+
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88,', array('127.0.0.1')),
919919
// forwarded for with remote IPv4 and all FF addrs trusted
920920
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1', '88.88.88.88')),
921921
// forwarded for with remote IPv4 range trusted

‎src/Symfony/Component/HttpKernel/HttpCache/SubRequestHandler.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpKernel/HttpCache/SubRequestHandler.php
+7-3Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ public static function handle(HttpKernelInterface $kernel, Request $request, $ty
5757
foreach ($trustedHeaders as $key => $name) {
5858
if ($trustedHeaderSet & $key) {
5959
$request->headers->remove($name);
60+
$request->server->remove('HTTP_'.strtoupper(str_replace('-', '_', $name)));
6061
}
6162
}
6263
}
@@ -76,13 +77,16 @@ public static function handle(HttpKernelInterface $kernel, Request $request, $ty
7677
// set trusted values, reusing as much as possible the global trusted settings
7778
if (Request::HEADER_FORWARDED & $trustedHeaderSet) {
7879
$trustedValues[0] .= sprintf(';host="%s";proto=%s', $request->getHttpHost(), $request->getScheme());
79-
$request->headers->set($trustedHeaders[Request::HEADER_FORWARDED], implode(', ', $trustedValues));
80+
$request->headers->set($name = $trustedHeaders[Request::HEADER_FORWARDED], $v = implode(', ', $trustedValues));
81+
$request->server->set('HTTP_'.strtoupper(str_replace('-', '_', $name)), $v);
8082
}
8183
if (Request::HEADER_X_FORWARDED_FOR & $trustedHeaderSet) {
82-
$request->headers->set($trustedHeaders[Request::HEADER_X_FORWARDED_FOR], implode(', ', $trustedIps));
84+
$request->headers->set($name = $trustedHeaders[Request::HEADER_X_FORWARDED_FOR], $v = implode(', ', $trustedIps));
85+
$request->server->set('HTTP_'.strtoupper(str_replace('-', '_', $name)), $v);
8386
} elseif (!(Request::HEADER_FORWARDED & $trustedHeaderSet)) {
8487
Request::setTrustedProxies($trustedProxies, $trustedHeaderSet | Request::HEADER_X_FORWARDED_FOR);
85-
$request->headers->set($trustedHeaders[Request::HEADER_X_FORWARDED_FOR], implode(', ', $trustedIps));
88+
$request->headers->set($name = $trustedHeaders[Request::HEADER_X_FORWARDED_FOR], $v = implode(', ', $trustedIps));
89+
$request->server->set('HTTP_'.strtoupper(str_replace('-', '_', $name)), $v);
8690
}
8791

8892
// fix the client IP address by setting it to 127.0.0.1,

‎src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ public function testRenderWithObjectsAsAttributes()
4747
$subRequest->attributes->replace(array('object' => $object, '_format' => 'html', '_controller' => 'main_controller', '_locale' => 'en'));
4848
$subRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
4949
$subRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
50+
$subRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
51+
$subRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
5052

5153
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($subRequest));
5254

@@ -101,6 +103,7 @@ public function testRenderWithTrustedHeaderDisabled()
101103

102104
$expectedSubRequest = Request::create('/');
103105
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
106+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
104107

105108
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
106109
$this->assertSame('foo', $strategy->render('/', Request::create('/'))->getContent());
@@ -193,8 +196,10 @@ public function testESIHeaderIsKeptInSubrequest()
193196

194197
if (Request::HEADER_X_FORWARDED_FOR & Request::getTrustedHeaderSet()) {
195198
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
199+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
196200
}
197201
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
202+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
198203

199204
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
200205

@@ -217,6 +222,8 @@ public function testHeadersPossiblyResultingIn304AreNotAssignedToSubrequest()
217222
$expectedSubRequest = Request::create('/');
218223
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
219224
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
225+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
226+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
220227

221228
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
222229
$request = Request::create('/', 'GET', array(), array(), array(), array('HTTP_IF_MODIFIED_SINCE' => 'Fri, 01 Jan 2016 00:00:00 GMT', 'HTTP_IF_NONE_MATCH' => '*'));
@@ -232,6 +239,8 @@ public function testFirstTrustedProxyIsSetAsRemote()
232239
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
233240
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
234241
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
242+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
243+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
235244

236245
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
237246

@@ -249,6 +258,8 @@ public function testIpAddressOfRangedTrustedProxyIsSetAsRemote()
249258
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
250259
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
251260
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
261+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
262+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
252263

253264
Request::setTrustedProxies(array('1.1.1.1/24'), -1);
254265

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.