8000 [HttpFoundation] Add $trustedHeader arg to Request::setTrustedProxies… · symfony/symfony@724fb7a · GitHub
[go: up one dir, main page]
Skip to content

Commit 724fb7a

Browse files
nicolas-grekasnicolas-grekas
committed
[HttpFoundation] Add $trustedHeader arg to Request::setTrustedProxies() - deprecate not setting it
1 parent aaa1437 commit 724fb7a

File tree

14 files changed

+216
-51
lines changed

14 files changed

+216
-51
lines changed

‎UPGRADE-3.3.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,16 @@ FrameworkBundle
166166
class has been deprecated and will be removed in 4.0. Use the
167167
`Symfony\Component\Routing\DependencyInjection\RoutingResolverPass` class instead.
168168

169+
HttpFoundation
170+
--------------
171+
172+
* The `Request::setTrustedProxies()` method takes a new `$trustedHeaderSet` argument - not setting it is deprecated.
173+
Set it to `Request::HEADER_FORWARDED` if your reverse-proxy uses the RFC7239 `Forwarded` header,
174+
or to `Request::HEADER_X_FORWARDED_ALL` if it is using `X-Forwarded-*` headers instead.
175+
176+
* The `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods are deprecated,
177+
use the RFC7239 `Forwarded` header, or the `X-Forwarded-*` headers instead.
178+
169179
HttpKernel
170180
-----------
171181

‎UPGRADE-4.0.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,15 @@ FrameworkBundle
274274
HttpFoundation
275275
---------------
276276

277+
HttpFoundation
278+
--------------
279+
280+
* The `Request::setTrustedProxies()` method takes a new `$trustedHeaderSet` argument.
281+
Set it to `Request::HEADER_FORWARDED` if your reverse-proxy uses the RFC7239 `Forwarded` header,
282+
or to `Request::HEADER_X_FORWARDED_ALL` if it is using `X-Forwarded-*` headers instead.
283+
284+
* The `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods have been removed.
285+
277286
* Extending the following methods of `Response`
278287
is no longer possible (these methods are now `final`):
279288

‎src/Symfony/Bridge/Monolog/Tests/Processor/WebProcessorTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ public function testUsesRequestServerData()
3636

3737
public function testUseRequestClientIp()
3838
{
39-
Request::setTrustedProxies(array('192.168.0.1'));
39+
Request::setTrustedProxies(array('192.168.0.1'), Request::HEADER_X_FORWARDED_ALL);
4040
list($event, $server) = $this->createRequestEvent(array('X_FORWARDED_FOR' => '192.168.0.2'));
4141

4242
$processor = new WebProcessor();

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Config\Definition\Builder\TreeBuilder;
1919
use Symfony\Component\Config\Definition\ConfigurationInterface;
2020
use Symfony\Component\Form\Form;
21+
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\Serializer\Serializer;
2223
use Symfony\Component\Translation\Translator;
2324
use Symfony\Component\Validator\Validation;

‎src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public function boot()
6060
ErrorHandler::register(null, false)->throwAt($this->container->getParameter('debug.error_handler.throw_at'), true);
6161

6262
if ($trustedProxies = $this->container->getParameter('kernel.trusted_proxies')) {
63-
Request::setTrustedProxies($trustedProxies);
63+
Request::setTrustedProxies($trustedProxies, Request::getTrustedHeaderSet());
6464
}
6565

6666
if ($this->container->getParameter('kernel.http_method_override')) {

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ CHANGELOG
44
3.3.0
55
-----
66

7+
* added `$trustedHeaderSet` argument to `Request::setTrustedProxies()` - deprecate not setting it,
8+
* deprecated the `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods,
79
* added `File\Stream`, to be passed to `BinaryFileResponse` when the size of the served file is unknown,
810
disabling `Range` and `Content-Length` handling, switching to chunked encoding instead
911
* added the `Cookie::fromString()` method that allows to create a cookie from a

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 69 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,21 @@
3030
*/
3131
class Request
3232
{
33-
const HEADER_FORWARDED = 'forwarded';
34-
const HEADER_CLIENT_IP = 'client_ip';
35-
const HEADER_CLIENT_HOST = 'client_host';
36-
const HEADER_CLIENT_PROTO = 'client_proto';
37-
const HEADER_CLIENT_PORT = 'client_port';
33+
const HEADER_FORWARDED = 0b00001;
34+
const HEADER_X_FORWARDED_ALL = 0b11110;
35+
const HEADER_X_FORWARDED_FOR = 2;
36+
const HEADER_X_FORWARDED_HOST = 4;
37+
const HEADER_X_FORWARDED_PROTO = 8;
38+
const HEADER_X_FORWARDED_PORT = 16;
39+
40+
/** @deprecated since version 3.3, to be removed in 4.0 */
41+
const HEADER_CLIENT_IP = self::HEADER_X_FORWARDED_FOR;
42+
/** @deprecated since version 3.3, to be removed in 4.0 */
43+
const HEADER_CLIENT_HOST = self::HEADER_X_FORWARDED_HOST;
44+
/** @deprecated since version 3.3, to be removed in 4.0 */
45+
const HEADER_CLIENT_PROTO = self::HEADER_X_FORWARDED_PROTO;
46+
/** @deprecated since version 3.3, to be removed in 4.0 */
47+
const HEADER_CLIENT_PORT = self::HEADER_X_FORWARDED_PORT;
3848

3949
const METHOD_HEAD = 'HEAD';
4050
const METHOD_GET = 'GET';
@@ -70,6 +80,8 @@ class Request
7080
*
7181
* The other headers are non-standard, but widely used
7282
* by popular reverse proxies (like Apache mod_proxy or Amazon EC2).
83+
*
84+
* @deprecated since version 3.3, to be removed in 4.0
7385
*/
7486
protected static $trustedHeaders = array(
7587
self::HEADER_FORWARDED => 'FORWARDED',
@@ -210,6 +222,17 @@ class Request
210222
private $isHostValid = true;
211223
private $isClientIpsValid = true;
212224

225+
private static $trustedHeaderSet = -1;
226+
227+
/** @deprecated since version 3.3, to be removed in 4.0 */
228+
private static $trustedHeaderNames = array(
229+
self::HEADER_FORWARDED => 'FORWARDED',
230+
self::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',
231+
self::HEADER_CLIENT_HOST => 'X_FORWARDED_HOST',
232+
self::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',
233+
self::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',
234+
);
235+
213236
/**
214237
* Constructor.
215238
*
@@ -548,11 +571,26 @@ public function overrideGlobals()
548571
*
549572
* You should only list the reverse proxies that you manage directly.
550573
*
551-
* @param array $proxies A list of trusted proxies
574+
* @param array $proxies A list of trusted proxies
575+
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, usually either Request::HEADER_FORWARDED or Request::HEADER_X_FORWARDED_ALL, to set which headers to trust from your proxies
576+
*
577+
* @throws \InvalidArgumentException When $trustedHeaderSet is invalid
552578
*/
553-
public static function setTrustedProxies(array $proxies)
579+
public static function setTrustedProxies(array $proxies/*, int $trustedHeaderSet*/)
554580
{
555581
self::$trustedProxies = $proxies;
582+
583+
if (2 > func_num_args()) {
584+
@trigger_error(sprintf('The %s() method expects a bit field of Request::HEADER_* as second argument. Not defining it is deprecated since version 3.3 and will be required in 4.0.', __METHOD__), E_USER_DEPRECATED);
585+
586+
return;
587+
}
588+
$trustedHeaderSet = func_get_arg(1);
589+
590+
foreach (self::$trustedHeaderNames as $header => $name) {
591+
self::$trustedHeaders[$header] = $header & $trustedHeaderSet ? $name : null;
592+
}
593+
self::$trustedHeaderSet = $trustedHeaderSet;
556594
}
557595

558596
/**
@@ -565,6 +603,16 @@ public static function getTrustedProxies()
565603
return self::$trustedProxies;
566604
}
567605

606+
/**
607+
* Gets the set of trusted headers from trusted proxies.
608+
*
609+
* @return int A bit field of Request::HEADER_* that defines which headers are trusted from your proxies
610+
*/
611+
public static function getTrustedHeaderSet()
612+
{
613+
return self::$trustedHeaderSet;
614+
}
615+
568616
/**
569617
* Sets a list of trusted host patterns.
570618
*
@@ -608,14 +656,22 @@ public static function getTrustedHosts()
608656
* @param string $value The header name
609657
*
610658
* @throws \InvalidArgumentException
659+
*
660+
* @deprecated since version 3.3, to be removed in 4.0. Use "X-Forwarded-*" headers or the "Forwarded" header defined in RFC7239, and the $trustedHeaderSet argument of the Request::setTrustedProxies() method instead.
611661
*/
612662
public static function setTrustedHeaderName($key, $value)
613663
{
664+
@trigger_error(sprintf('The "%s()" method is deprecated since version 3.3 and will be removed in 4.0. Use "X-Forwarded-*" headers or the "Forwarded" header defined in RFC7239, and the $trustedHeaderSet argument of the Request::setTrustedProxies() method instead.', __METHOD__), E_USER_DEPRECATED);
665+
614666
if (!array_key_exists($key, self::$trustedHeaders)) {
615667
throw new \InvalidArgumentException(sprintf('Unable to set the trusted header name for key "%s".', $key));
616668
}
617669

618670
self::$trustedHeaders[$key] = $value;
671+
672+
if (null !== $value) {
673+
self::$trustedHeaderNames[$key] = $value;
674+
}
619675
}
620676

621677
/**
@@ -626,9 +682,15 @@ public static function setTrustedHeaderName($key, $value)
626682
* @return string The header name
627683
*
628684
* @throws \InvalidArgumentException
685+
*
686+
* @deprecated since version 3.3, to be removed in 4.0. Use the Request::getTrustedHeaderSet() method instead.
629687
*/
630688
public static function getTrustedHeaderName($key)
631689
{
690+
if (2 > func_num_args() || func_get_arg(1)) {
691+
@trigger_error(sprintf('The "%s()" method is deprecated since version 3.3 and will be removed in 4.0. Use the Request::getTrustedHeaderSet() method instead.', __METHOD__), E_USER_DEPRECATED);
692+
}
693+
632694
if (!array_key_exists($key, self::$trustedHeaders)) {
633695
throw new \InvalidArgumentException(sprintf('Unable to get the trusted header name for key "%s".', $key));
634696
}

0 commit comments

Comments
 (0)
0