Skip to content

Commit 759c32b

Browse files
neclimdulfabpot
neclimdul
authored and
fabpot
committed
isFromTrustedProxy to confirm request came from a trusted proxy.
1 parent 5c12bcb commit 759c32b

File tree

2 files changed

+34
-17
lines changed

2 files changed

+34
-17
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -814,7 +814,7 @@ public function getClientIps()
814814
{
815815
$ip = $this->server->get('REMOTE_ADDR');
816816

817-
if (!self::$trustedProxies) {
817+
if (!$this->isFromTrustedProxy()) {
818818
return array($ip);
819819
}
820820

@@ -980,7 +980,7 @@ public function getScheme()
980980
*/
981981
public function getPort()
982982
{
983-
if (self::$trustedProxies) {
983+
if ($this->isFromTrustedProxy()) {
984984
if (self::$trustedHeaders[self::HEADER_CLIENT_PORT] && $port = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PORT])) {
985985
return $port;
986986
}
@@ -1161,7 +1161,7 @@ public function getQueryString()
11611161
*/
11621162
public function isSecure()
11631163
{
1164-
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
1164+
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_PROTO] && $proto = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_PROTO])) {
11651165
return in_array(strtolower(current(explode(',', $proto))), array('https', 'on', 'ssl', '1'));
11661166
}
11671167

@@ -1189,7 +1189,7 @@ public function isSecure()
11891189
*/
11901190
public function getHost()
11911191
{
1192-
if (self::$trustedProxies && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
1192+
if ($this->isFromTrustedProxy() && self::$trustedHeaders[self::HEADER_CLIENT_HOST] && $host = $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_HOST])) {
11931193
$elements = explode(',', $host);
11941194

11951195
$host = $elements[count($elements) - 1];
@@ -1905,4 +1905,9 @@ private static function createRequestFromFactory(array $query = array(), array $
19051905

19061906
return new static($query, $request, $attributes, $cookies, $files, $server, $content);
19071907
}
1908+
1909+
private function isFromTrustedProxy()
1910+
{
1911+
return self::$trustedProxies && IpUtils::checkIp($this->server->get('REMOTE_ADDR'), self::$trustedProxies);
1912+
}
19081913
}

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -723,35 +723,37 @@ public function testGetPort()
723723
'HTTP_X_FORWARDED_PROTO' => 'https',
724724
'HTTP_X_FORWARDED_PORT' => '8443',
725725
));
726-
$port = $request->getPort();
727-
728-
$this->assertEquals(8443, $port, 'With PROTO and PORT set PORT takes precedence.');
726+
$this->assertEquals(80, $request->getPort(), 'With PROTO and PORT on untrusted connection server value takes precedence.');
727+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
728+
$this->assertEquals(8443, $request->getPort(), 'With PROTO and PORT set PORT takes precedence.');
729729

730730
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
731731
'HTTP_X_FORWARDED_PROTO' => 'https',
732732
));
733-
$port = $request->getPort();
734-
735-
$this->assertEquals(443, $port, 'With only PROTO set getPort() defaults to 443.');
733+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set getPort() ignores trusted headers on untrusted connection.');
734+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
735+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set getPort() defaults to 443.');
736736

737737
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
738738
'HTTP_X_FORWARDED_PROTO' => 'http',
739739
));
740-
$port = $request->getPort();
741-
742-
$this->assertEquals(80, $port, 'If X_FORWARDED_PROTO is set to HTTP return 80.');
740+
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() ignores trusted headers on untrusted connection.');
741+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
742+
$this->assertEquals(80, $request->getPort(), 'If X_FORWARDED_PROTO is set to HTTP getPort() returns port of the original request.');
743743

744744
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
745745
'HTTP_X_FORWARDED_PROTO' => 'On',
746746
));
747-
$port = $request->getPort();
748-
$this->assertEquals(443, $port, 'With only PROTO set and value is On, getPort() defaults to 443.');
747+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is On, getPort() ignores trusted headers on untrusted connection.');
748+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
749+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is On, getPort() defaults to 443.');
749750

750751
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
751752
'HTTP_X_FORWARDED_PROTO' => '1',
752753
));
753-
$port = $request->getPort();
754-
$this->assertEquals(443, $port, 'With only PROTO set and value is 1, getPort() defaults to 443.');
754+
$this->assertEquals(80, $request->getPort(), 'With only PROTO set and value is 1, getPort() ignores trusted headers on untrusted connection.');
755+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
756+
$this->assertEquals(443, $request->getPort(), 'With only PROTO set and value is 1, getPort() defaults to 443.');
755757

756758
$request = Request::create('http://example.com', 'GET', array(), array(), array(), array(
757759
'HTTP_X_FORWARDED_PROTO' => 'something-else',
@@ -1021,6 +1023,8 @@ public function testOverrideGlobals()
10211023
$request->headers->set('X_FORWARDED_PROTO', 'https');
10221024

10231025
Request::setTrustedProxies(array('1.1.1.1'));
1026+
$this->assertFalse($request->isSecure());
1027+
$request->server->set('REMOTE_ADDR', '1.1.1.1');
10241028
$this->assertTrue($request->isSecure());
10251029
Request::setTrustedProxies(array());
10261030

@@ -1480,7 +1484,15 @@ public function testTrustedProxies()
14801484
$this->assertEquals(443, $request->getPort());
14811485
$this->assertTrue($request->isSecure());
14821486

1487+
// trusted proxy via setTrustedProxies()
1488+
Request::setTrustedProxies(array('3.3.3.4', '2.2.2.2'));
1489+
$this->assertEquals('3.3.3.3', $request->getClientIp());
1490+
$this->assertEquals('example.com', $request->getHost());
1491+
$this->assertEquals(80, $request->getPort());
1492+
$this->assertFalse($request->isSecure());
1493+
14831494
// check various X_FORWARDED_PROTO header values
1495+
Request::setTrustedProxies(array('3.3.3.3', '2.2.2.2'));
14841496
$request->headers->set('X_FORWARDED_PROTO', 'ssl');
14851497
$this->assertTrue($request->isSecure());
14861498

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy