8000 bug #21846 [HttpFoundation] Fix Request::getHost() when having severa… · symfony/symfony@d5d3953 · GitHub
[go: up one dir, main page]
Skip to content

Commit d5d3953

Browse files
fabpotfabpot
committed
bug #21846 [HttpFoundation] Fix Request::getHost() when having several hosts in X_FORWARDED_HOST (nicolas-grekas)
This PR was merged into the 2.7 branch. Discussion ---------- [HttpFoundation] Fix Request::getHost() when having several hosts in X_FORWARDED_HOST | Q | A | ------------- | --- | Branch? | 2.7 | Bug fix? | yes | New feature? | no | BC breaks? | no | Deprecations? | no | Tests pass? | yes | Fixed tickets | - | License | MIT | Doc PR | - The first "host" in the list provided by `X_FORWARDED_HOST` should be the one, not the last. Already the case for "port" and "scheme". Commits ------- 9a2b2de [HttpFoundation] Fix Request::getHost() when having several hosts in X_FORWARDED_HOST
2 parents d45f940 + 3f1051a commit d5d3953

File tree

2 files changed

+5
-5
lines changed

2 files changed

+5
-5
lines changed

‎Request.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -962,7 +962,7 @@ public function getPort()
962962
{
963963
if ($this->isFromTrustedProxy()) {
964964
if (self::$trustedHeaders[self::HEADER_CLIENT_PORT] && $port = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PORT])) {
965-
return $port;
965+
return (int) $port;
966966
}
967967

968968
if (self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && 'https' === $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO], 'http')) {
@@ -1211,9 +1211,9 @@ public function isSecure()
12111211
public function getHost()
12121212
{
12131213
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
1214-
$elements = explode(',', $host);
1214+
$elements = explode(',', $host, 2);
12151215

1216-
$host = $elements[count($elements) - 1];
1216+
$host = $elements[0];
12171217
} elseif (!$host = $this->headers->get('HOST')) {
12181218
if (!$host = $this->server->get('SERVER_NAME')) {
12191219
$host = $this->server->get('SERVER_ADDR', '');

‎Tests/RequestTest.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1636,7 +1636,7 @@ public function testTrustedProxies()
16361636
$request = Request::create('http://example.com/');
16371637
$request->server->set('REMOTE_ADDR', '3.3.3.3');
16381638
$request->headers->set('X_FORWARDED_FOR', '1.1.1.1, 2.2.2.2');
1639-
$request->headers->set('X_FORWARDED_HOST', 'foo.example.com, real.example.com:8080');
1639+
$request->headers->set('X_FORWARDED_HOST', 'foo.example.com:1234, real.example.com:8080');
16401640
$request->headers->set('X_FORWARDED_PROTO', 'https');
16411641
$request->headers->set('X_FORWARDED_PORT', 443);
16421642
$request->headers->set('X_MY_FOR', '3.3.3.3, 4.4.4.4');
@@ -1667,7 +1667,7 @@ public function testTrustedProxies()
16671667
// trusted proxy via setTrustedProxies()
16681668
Request::setTrustedProxies(array('3.3.3.3', '2.2.2.2'));
16691669
$this->assertEquals('1.1.1.1', $request->getClientIp());
1670-
$this->assertEquals('real.example.com', $request->getHost());
1670+
$this->assertEquals('foo.example.com', $request->getHost());
16711671
$this->assertEquals(443, $request->getPort());
16721672
$this->assertTrue($request->isSecure());
16731673

0 commit comments

Comments
 (0)
0