Skip to content

Commit 4a7a68e

Browse files
nicolas-grekasnicolas-grekas
committed
feature #58154 [HttpFoundation] Add PRIVATE_SUBNETS as a shortcut for private IP address ranges to Request::setTrustedProxies() (nicolas-grekas)
This PR was merged into the 7.2 branch. Discussion ---------- [HttpFoundation] Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()` | Q | A | ------------- | --- | Branch? | 7.2 | Bug fix? | no | New feature? | no | Deprecations? | no | Issues | - | License | MIT Let's save some memory allocations and callbacks when we can. Tweaks #33574 and #52924 Commits ------- 6bd4b4a [HttpFoundation] Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()`
2 parents 84f4837 + 6bd4b4a commit 4a7a68e

File tree

5 files changed

+41
-23
lines changed

5 files changed

+41
-23
lines changed

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -111,10 +111,10 @@ public function getConfigTreeBuilder(): TreeBuilder
111111
->beforeNormalization()->ifString()->then(fn ($v) => [$v])->end()
112112
->prototype('scalar')->end()
113113
->end()
114-
->scalarNode('trusted_proxies')
114+
->variableNode('trusted_proxies')
115115
->beforeNormalization()
116-
->ifTrue(fn ($v) => 'private_ranges' === $v)
117-
->then(fn ($v) => implode(',', IpUtils::PRIVATE_SUBNETS))
116+
->ifTrue(fn ($v) => 'private_ranges' === $v || 'PRIVATE_SUBNETS' === $v)
117+
->then(fn () => IpUtils::PRIVATE_SUBNETS)
118118
->end()
119119
->end()
120120
->arrayNode('trusted_headers')

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTestCase.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2354,7 +2354,7 @@ public function testTrustedProxiesWithPrivateRanges()
23542354
{
23552355
$container = $this->createContainerFromFile('trusted_proxies_private_ranges');
23562356

2357-
$this->assertSame(IpUtils::PRIVATE_SUBNETS, array_map('trim', explode(',', $container->getParameter('kernel.trusted_proxies'))));
2357+
$this->assertSame(IpUtils::PRIVATE_SUBNETS, $container->getParameter('kernel.trusted_proxies'));
23582358
}
23592359

23602360
public function testWebhook()

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ CHANGELOG
66

77
* Add optional `$requests` parameter to `RequestStack::__construct()`
88
* Add optional `$v4Bytes` and `$v6Bytes` parameters to `IpUtils::anonymize()`
9+
* Add `PRIVATE_SUBNETS` as a shortcut for private IP address ranges to `Request::setTrustedProxies()`
910

1011
7.1
1112
---

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -520,20 +520,26 @@ public function overrideGlobals(): void
520520
*
521521
* You should only list the reverse proxies that you manage directly.
522522
*
523-
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR']
524-
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, to set which headers to trust from your proxies
523+
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR'] and 'PRIVATE_SUBNETS' by IpUtils::PRIVATE_SUBNETS
524+
* @param int-mask-of<Request::HEADER_*> $trustedHeaderSet A bit field to set which headers to trust from your proxies
525525
*/
526526
public static function setTrustedProxies(array $proxies, int $trustedHeaderSet): void
527527
{
528-
self::$trustedProxies = array_reduce($proxies, function ($proxies, $proxy) {
529-
if ('REMOTE_ADDR' !== $proxy) {
530-
$proxies[] = $proxy;
531-
} elseif (isset($_SERVER['REMOTE_ADDR'])) {
532-
$proxies[] = $_SERVER['REMOTE_ADDR'];
528+
if (false !== $i = array_search('REMOTE_ADDR', $proxies, true)) {
529+
if (isset($_SERVER['REMOTE_ADDR'])) {
530+
$proxies[$i] = $_SERVER['REMOTE_ADDR'];
531+
} else {
532+
unset($proxies[$i]);
533+
$proxies = array_values($proxies);
533534
}
535+
}
536+
537+
if (false !== ($i = array_search('PRIVATE_SUBNETS', $proxies, true)) || false !== ($i = array_search('private_ranges', $proxies, true))) {
538+
unset($proxies[$i]);
539+
$proxies = array_merge($proxies, IpUtils::PRIVATE_SUBNETS);
540+
}
534541

535-
return $proxies;
536-
}, []);
542+
self::$trustedProxies = $proxies;
537543
self::$trustedHeaderSet = $trustedHeaderSet;
538544
}
539545

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use Symfony\Component\HttpFoundation\Exception\JsonException;
1717
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
1818
use Symfony\Component\HttpFoundation\InputBag;
19+
use Symfony\Component\HttpFoundation\IpUtils;
1920
use Symfony\Component\HttpFoundation\ParameterBag;
2021
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\HttpFoundation\Session\Session;
@@ -2564,6 +2565,26 @@ public function testTrustedProxiesRemoteAddr($serverRemoteAddr, $trustedProxies,
25642565
$this->assertSame($result, Request::getTrustedProxies());
25652566
}
25662567

2568+
public static function trustedProxiesRemoteAddr()
2569+
{
2570+
return [
2571+
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
2572+
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
2573+
[null, ['REMOTE_ADDR'], []],
2574+
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
2575+
];
2576+
}
2577+
2578+
/**
2579+
* @testWith ["PRIVATE_SUBNETS"]
2580+
* ["private_ranges"]
2581+
*/
2582+
public function testTrustedProxiesPrivateSubnets(string $key)
2583+
{
2584+
Request::setTrustedProxies([$key], Request::HEADER_X_FORWARDED_FOR);
2585+
$this->assertSame(IpUtils::PRIVATE_SUBNETS, Request::getTrustedProxies());
2586+
}
2587+
25672588
public function testTrustedValuesCache()
25682589
{
25692590
$request = Request::create('http://example.com/');
@@ -2581,16 +2602,6 @@ public function testTrustedValuesCache()
25812602
$this->assertFalse($request->isSecure());
25822603
}
25832604

2584-
public static function trustedProxiesRemoteAddr()
2585-
{
2586-
return [
2587-
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
2588-
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
2589-
[null, ['REMOTE_ADDR'], []],
2590-
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
2591-
];
2592-
}
2593-
25942605
/**
25952606
* @dataProvider preferSafeContentData
25962607
*/

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy