8000 isFromTrustedProxy to confirm request came from a trusted proxy. · symfony/symfony@759c32b · GitHub
[go: up one dir, main page]
Skip to content

Commit 759c32b

Browse files
neclimdulfabpot
neclimdul
authored and
fabpot
committed
isFromTrustedProxy to confirm request came from a trusted proxy.
1 parent 5c12bcb commit 759c32b

File tree

2 files changed

+34
-17
lines changed

2 files changed

+34
-17
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -814,7 +814,7 @@ public function getClientIps()
814814
{
815815
$ip = $this->server->get('REMOTE_ADDR');
816816

817-
if (!self::$trustedProxies) {
817+
if (!$this->isFromTrustedProxy()) {
818818
return array($ip);
819819
}
820820

@@ -980,7 +980,7 @@ public function getScheme()
980980
*/
981981
public function getPort()
982982
{
983-
if (self::$trustedProxies) {
983+
if ($this->isFromTrustedProxy()) {
984984
if (self::$trustedHeaders[self::HEADER_CLIENT_PORT] && $port = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PORT])) {
985985
return $port;
986986
}
@@ -1161,7 +1161,7 @@ public function getQueryString()
11611161
*/
11621162
public function isSecure()
11631163
{
1164-
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
1164+
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
11651165
return in_array(strtolower(current(explode(',', $proto))), array('https', 'on', 'ssl', '1'));
11661166
}
11671167

@@ -1189,7 +1189,7 @@ public function isSecure()
11891189
*/
11901190
public function getHost()
11911191
{
1192-
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
1192+
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
11931193
$elements = explode(',', $host);
11941194

11951195
$host = $elements[count($elements) - 1];
@@ -1905,4 +1905,9 @@ private static function createRequestFromFactory(array $query = array(), array $
19051905

19061906
return new static($query, $request, $attributes, $cookies, $files, $server, $content);
19071907
}
1908+
1909+
private function isFromTrustedProxy()
1910+
{
1911+
return self::$trustedProxies && IpUtils::checkIp($this->server->get('REMOTE_ADDR'), self::$trustedProxies);
1912+
}
19081913
}

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -723,35 +723,37 @@ public function testGetPort()
723723
'HTTP_X_FORWARDED_PROTO' => 'https',
724724
'HTTP_X_FORWARDED_PORT' => '8443',
725725
));
726-
$port = $request->getPort();
727-
728-
$this->assertEquals(8443, $port, 'With PROTO and PORT set PORT takes precedence.');
726+
$this->assertEquals(80, $request->getPort(), 'With PROTO and PORT on untrusted connection server value takes precedence.');
727+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
728+
$this->assertEquals(8443, $request->getPort(), 'With PROTO and PORT set PORT takes precedence.');
729729

730730
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
731731
'HTTP_X_FORWARDED_PROTO' => 'https',
732732
));
733-
$port = $request->getPort();
734-
735-
$this->assertEquals(443, $port, 'With only PROTO set getPort() defaults to 443.');
733+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set getPort() ignores trusted headers on untrusted connection.');
734+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
735+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set getPort() defaults to 443.');
736736

737737
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
738738
'HTTP_X_FORWARDED_PROTO' => 'http',
739739
));
740-
$port = $request->getPort();
741-
742-
$this->assertEquals(80, $port, 'If X_FORWARDED_PROTO is set to HTTP return 80.');
740+
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() ignores trusted headers on untrusted connection.');
741+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
742+
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() returns port of the original request.');
743743

744744
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
745745
'HTTP_X_FORWARDED_PROTO' => 'On',
746746
));
747-
$port = $request->getPort();
748-
$this->assertEquals(443, $port, 'With only PROTO set and value is On, getPort() defaults to 443.');
747+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is On, getPort() ignores trusted headers on untrusted connection.');
748+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
749+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is On, getPort() defaults to 443.');
749750

750751
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
751752
'HTTP_X_FORWARDED_PROTO' => '1',
752753
));
753-
$port = $request->getPort();
754-
$this->assertEquals(443, $port, 'With only PROTO set and value is 1, getPort() defaults to 443.');
754+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is 1, getPort() ignores trusted headers on untrusted connection.');
755+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
756+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is 1, getPort() defaults to 443.');
755757

756758
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
757759
'HTTP_X_FORWARDED_PROTO' => 'something-else',
@@ -1021,6 +1023,8 @@ public function testOverrideGlobals()
10211023
$request->headers->set('X_FORWARDED_PROTO', 'https');
10221024

10231025
Request::setTrustedProxies(array('1.1.1.1'));
1026+
$this->assertFalse($request->isSecure());
1027+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
10241028
$this->assertTrue($request->isSecure());
10251029
Request::setTrustedProxies(array());
10261030

@@ -1480,7 +1484,15 @@ public function testTrustedProxies()
14801484
$this->assertEquals(443, $request->getPort());
14811485
$this->assertTrue($request->isSecure());
14821486

1487+
// trusted proxy via setTrustedProxies()
1488+
Request::setTrustedProxies(array('3.3.3.4', '2.2.2.2'));
1489+
$this->assertEquals('3.3.3.3', $request->getClientIp());
1490+
$this->assertEquals('example.com', $request->getHost());
1491+
$this->assertEquals(80, $request->getPort());
1492+
$this->assertFalse($request->isSecure());
1493+
14831494
// check various X_FORWARDED_PROTO header values
1495+
Request::setTrustedProxies(array('3.3.3.3', '2.2.2.2'));
14841496
$request->headers->set('X_FORWARDED_PROTO', 'ssl');
14851497
$this->assertTrue($request->isSecure());
14861498

0 commit comments

Comments
 (0)
0