8000 [HttpFoundation] Add `PRIVATE_SUBNETS` as a shortcut for private IP a… · symfony/symfony@c69c923 · GitHub
[go: up one dir, main page]
Skip to content

Commit c69c923

Browse files
nicolas-grekasnicolas-grekas
committed
[HttpFoundation] Add PRIVATE_SUBNETS as a shortcut for private IP address ranges to Request::setTrustedProxies() 
1 parent 1958d21 commit c69c923

File tree

4 files changed

+35
-21
lines changed

4 files changed

+35
-21
lines changed

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,8 +113,8 @@ public function getConfigTreeBuilder(): TreeBuilder
113113
->end()
114114
->scalarNode('trusted_proxies')
115115
->beforeNormalization()
116-
->ifTrue(fn ($v) => 'private_ranges' === $v)
117-
->then(fn ($v) => implode(',', IpUtils::PRIVATE_SUBNETS))
116+
->ifTrue(fn ($v) => 'private_ranges' === $v || 'PRIVATE_SUBNETS' === $v)
117+
->then(fn () => IpUtils::PRIVATE_SUBNETS)
118118
->end()
119119
->end()
120120
->arrayNode('trusted_headers')

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ CHANGELOG
66

77
* Add optional `$requests` parameter to `RequestStack::__construct()`
88
* Add optional `$v4Bytes` and `$v6Bytes` parameters to `IpUtils::anonymize()`
9+
* Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()`
910

1011
7.1
1112
---

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -520,20 +520,26 @@ public function overrideGlobals(): void
520520
*
521521
* You should only list the reverse proxies that you manage directly.
522522
*
523-
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR']
524-
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, to set which headers to trust from your proxies
523+
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR']
524+
* @param int-mask-of<Request::HEADER_*> $trustedHeaderSet A bit field to set which headers to trust from your proxies
525525
*/
526526
public static function setTrustedProxies(array $proxies, int $trustedHeaderSet): void
527527
{
528-
self::$trustedProxies = array_reduce($proxies, function ($proxies, $proxy) {
529-
if ('REMOTE_ADDR' !== $proxy) {
530-
$proxies[] = $proxy;
531-
} elseif (isset($_SERVER['REMOTE_ADDR'])) {
532-
$proxies[] = $_SERVER['REMOTE_ADDR'];
528+
if (false !== $i = array_search('REMOTE_ADDR', $proxies, true)) {
529+
if (isset($_SERVER['REMOTE_ADDR'])) {
530+
$proxies[$i] = $_SERVER['REMOTE_ADDR'];
531+
} else {
532+
unset($proxies[$i]);
533+
$proxies = array_values($proxies);
533534
}
5 10000 35+
}
536+
537+
if (false !== $i = array_search('PRIVATE_SUBNETS', $proxies, true)) {
538+
unset($proxies[$i]);
539+
$proxies = array_merge($proxies, IpUtils::PRIVATE_SUBNETS);
540+
}
534541

535-
return $proxies;
536-
}, []);
542+
self::$trustedProxies = $proxies;
537543
self::$trustedHeaderSet = $trustedHeaderSet;
538544
}
539545

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use Symfony\Component\HttpFoundation\Exception\JsonException;
1717
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
1818
use Symfony\Component\HttpFoundation\InputBag;
19+
use Symfony\Component\HttpFoundation\IpUtils;
1920
use Symfony\Component\HttpFoundation\ParameterBag;
2021
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\HttpFoundation\Session\Session;
@@ -2564,6 +2565,22 @@ public function testTrustedProxiesRemoteAddr($serverRemoteAddr, $trustedProxies,
25642565
$this->assertSame($result, Request::getTrustedProxies());
25652566
}
25662567

2568+
public static function trustedProxiesRemoteAddr()
2569+
{
2570+
return [
2571+
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
2572+
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
2573+
[null, ['REMOTE_ADDR'], []],
2574+
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
2575+
];
2576+
}
2577+
2578+
public function testTrustedProxiesPrivateSubnets()
2579+
{
2580+
Request::setTrustedProxies(['PRIVATE_SUBNETS'], Request::HEADER_X_FORWARDED_FOR);
2581+
$this->assertSame(IpUtils::PRIVATE_SUBNETS, Request::getTrustedProxies());
2582+
}
2583+
25672584
public function testTrustedValuesCache()
25682585
{
25692586
$request = Request::create('http://example.com/');
@@ -2581,16 +2598,6 @@ public function testTrustedValuesCache()
25812598
$this->assertFalse($request->isSecure());
25822599
}
25832600

2584-
public static function trustedProxiesRemoteAddr()
2585-
{
2586-
return [
2587-
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
2588-
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
2589-
[null, ['REMOTE_ADDR'], []],
2590-
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
2591-
];
2592-
}
2593-
25942601
/**
25952602
* @dataProvider preferSafeContentData
25962603
*/

0 commit comments

Comments
 (0)
0