8000 feature #58154 [HttpFoundation] Add `PRIVATE_SUBNETS` as a shortcut f… · symfony/symfony@4a7a68e · GitHub
[go: up one dir, main page]
Skip to content

Commit 4a7a68e

Browse files
nicolas-grekasnicolas-grekas
committed
feature #58154 [HttpFoundation] Add PRIVATE_SUBNETS as a shortcut for private IP address ranges to Request::setTrustedProxies() (nicolas-grekas)
This PR was merged into the 7.2 branch. Discussion ---------- [HttpFoundation] Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()` | Q | A | ------------- | --- | Branch? | 7.2 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | - | License | MIT Let's save some memory allocations and callbacks when we can. Tweaks #33574 and #52924 Commits ------- 6bd4b4a [HttpFoundation] Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()`
2 parents 84f4837 + 6bd4b4a commit 4a7a68e

File tree

5 files changed

+41
-23
lines changed

5 files changed

+41
-23
lines changed

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,10 +111,10 @@ public function getConfigTreeBuilder(): TreeBuilder
111111
->beforeNormalization()->ifString()->then(fn ($v) => [$v])->end()
112112
->prototype('scalar')->end()
113113
->end()
114-
->scalarNode('trusted_proxies')
114+
->variableNode('trusted_proxies')
115115
->beforeNormalization()
116-
->ifTrue(fn ($v) => 'private_ranges' === $v)
117-
->then(fn ($v) => implode(',', IpUtils::PRIVATE_SUBNETS))
116+
->ifTrue(fn ($v) => 'private_ranges' === $v || 'PRIVATE_SUBNETS' === $v)
117+
->then(fn () => IpUtils::PRIVATE_SUBNETS)
118118
->end()
119119
->end()
120120
->arrayNode('trusted_headers')

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTestCase.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2354,7 +2354,7 @@ public function testTrustedProxiesWithPrivateRanges()
23542354
{
23552355
$container = $this->createContainerFromFile('trusted_proxies_private_ranges');
23562356

2357-
$this->assertSame(IpUtils::PRIVATE_SUBNETS, array_map('trim', explode(',', $container->getParameter('kernel.trusted_proxies'))));
2357+
$this->assertSame(IpUtils::PRIVATE_SUBNETS, $container->getParameter('kernel.trusted_proxies'));
23582358
}
23592359

23602360
public function testWebhook()

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ CHANGELOG
66

77
* Add optional `$requests` parameter to `RequestStack::__construct()`
88
* Add optional `$v4Bytes` and `$v6Bytes` parameters to `IpUtils::anonymize()`
9+
* Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()`
910

1011
7.1
1112
---

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -520,20 +520,26 @@ public function overrideGlobals(): void
520520
*
521521
* You should only list the reverse proxies that you manage directly.
522522
*
523-
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR']
524-
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, to set which headers to trust from your proxies
523+
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR'] and 'PRIVATE_SUBNETS' by IpUtils::PRIVATE_SUBNETS
524+
* @param int-mask-of<Request::HEADER_*> $trustedHeaderSet A bit field to set which headers to trust from your proxies
525525
*/
526526
public static function setTrustedProxies(array $proxies, int $trustedHeaderSet): void
527527
{
528-
self::$trustedProxies = array_reduce($proxies, function ($proxies, $proxy) {
529-
if ('REMOTE_ADDR' !== $proxy) {
530-
$proxies[] = $proxy;
531-
} elseif (isset($_SERVER['REMOTE_ADDR'])) {
532-
$proxies[] = $_SERVER['REMOTE_ADDR'];
528+
if (false !== E864 $i = array_search('REMOTE_ADDR', $proxies, true)) {
529+
if (isset($_SERVER['REMOTE_ADDR'])) {
530+
$proxies[$i] = $_SERVER['REMOTE_ADDR'];
531+
} else {
532+
unset($proxies[$i]);
533+
$proxies = array_values($proxies);
533534
}
535+
}
536+
537+
if (false !== ($i = array_search('PRIVATE_SUBNETS', $proxies, true)) || false !== ($i = array_search('private_ranges', $proxies, true))) {
538+
unset($proxies[$i]);
539+
$proxies = array_merge($proxies, IpUtils::PRIVATE_SUBNETS);
540+
}
534541

535-
return $proxies;
536-
}, []);
542+
self::$trustedProxies = $proxies;
537543
self::$trustedHeaderSet = $trustedHeaderSet;
538544
}
539545

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use Symfony\Component\HttpFoundation\Exception\JsonException;
1717
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
1818
use Symfony\Component\HttpFoundation\InputBag;
19+
use Symfony\Component\HttpFoundation\IpUtils;
1920
use Symfony\Component\HttpFoundation\ParameterBag;
2021
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\HttpFoundation\Session\Session;
@@ -2564,6 +2565,26 @@ public function testTrustedProxiesRemoteAddr($serverRemoteAddr, $trustedProxies,
25642565
$this->assertSame($result, Request::getTrustedProxies());
25652566
}
25662567

2568+
public static function trustedProxiesRemoteAddr()
2569+
{
2570+
return [
2571+
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
2572+
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
2573+
[null, ['REMOTE_ADDR'], []],
2574+
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
2575+
];
2576+
}
2577+
2578+
/**
2579+
* @testWith ["PRIVATE_SUBNETS"]
2580+
* ["private_ranges"]
2581+
*/
2582+
public function testTrustedProxiesPrivateSubnets(string $key)
2583+
{
2584+
Request::setTrustedProxies([$key], Request::HEADER_X_FORWARDED_FOR);
2585+
$this->assertSame(IpUtils::PRIVATE_SUBNETS, Request::getTrustedProxies());
2586+
}
2587+
25672588
public function testTrustedValuesCache()
25682589
{
25692590
$request = Request::create('http://example.com/');
@@ -2581,16 +2602,6 @@ public function testTrustedValuesCache()
25812602
$this->assertFalse($request->isSecure());
25822603
}
25832604

2584-
public static function trustedProxiesRemoteAddr()
2585-
{
2586-
return [
2587-
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
2588-
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
2589-
[null, ['REMOTE_ADDR'], []],
2590-
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
2591-
];
2592-
}
2593-
25942605
/**
25952606
* @dataProvider preferSafeContentData
25962607
*/

0 commit comments

Comments
 (0)
0