bug #40547 [RateLimiter] Security hardening - Rate limiter (jderusse)

Nyholm · Nyholm · commit 0f4870b23fd5 · 2021-03-23T08:09:52.000+01:00
This PR was merged into the 5.2 branch. Discussion ---------- [RateLimiter] Security hardening - Rate limiter | Q | A | ------------- | --- | Branch? | 5.2 | Bug fix? | yes | New feature? | no | Deprecations? | yes | Tickets | - | License | MIT | Doc PR | - Commits ------- e61553a Security hardening - Rate limiter
diff --git a/src/Symfony/Component/RateLimiter/RateLimiterFactory.php b/src/Symfony/Component/RateLimiter/RateLimiterFactory.php
@@ -46,7 +46,7 @@ public function __construct(array $config, StorageInterface $storage, ?LockFacto
 
     public function create(?string $key = null): LimiterInterface
     {
-        $id = $this->config['id'].$key;
+        $id = $this->config['id'].'-'.$key;
         $lock = $this->lockFactory ? $this->lockFactory->createLock($id) : new NoLock();
 
         switch ($this->config['policy']) {
diff --git a/src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php b/src/Symfony/Component/Security/Http/RateLimiter/DefaultLoginRateLimiter.php
@@ -41,7 +41,7 @@ protected function getLimiters(Request $request): array
     {
         return [
             $this->globalFactory->create($request->getClientIp()),
-            $this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).$request->getClientIp()),
+            $this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).'-'.$request->getClientIp()),
         ];
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -46,7 +46,7 @@ public function __construct(array $config, StorageInterface $storage, ?LockFacto`
`46`	`46`
`47`	`47`	`public function create(?string $key = null): LimiterInterface`
`48`	`48`	`{`
`49`		`- $id = $this->config['id'].$key;`
	`49`	`+ $id = $this->config['id'].'-'.$key;`
`50`	`50`	`$lock = $this->lockFactory ? $this->lockFactory->createLock($id) : new NoLock();`
`51`	`51`
`52`	`52`	`switch ($this->config['policy']) {`
Original file line number	Diff line number	Diff line change
`@@ -41,7 +41,7 @@ protected function getLimiters(Request $request): array`
`41`	`41`	`{`
`42`	`42`	`return [`
`43`	`43`	`$this->globalFactory->create($request->getClientIp()),`
`44`		`- $this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).$request->getClientIp()),`
	`44`	`+ $this->localFactory->create($request->attributes->get(Security::LAST_USERNAME).'-'.$request->getClientIp()),`
`45`	`45`	`];`
`46`	`46`	`}`
`47`	`47`	`}`