Skip to content

Commit 96e0833

Browse files
nicolas-grekasnicolas-grekas
committed
Merge branch '2.8' into 3.4
* 2.8: [HttpKernel] fix forwarding trusted headers as server parameters
2 parents 24e8bc2 + 2554ad0 commit 96e0833

File tree

4 files changed

+22
-7
lines changed

4 files changed

+22
-7
lines changed

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2134,7 +2134,7 @@ private function normalizeAndFilterClientIps(array $clientIps, $ip)
21342134
if ($i) {
21352135
$clientIps[$key] = $clientIp = substr($clientIp, 0, $i);
21362136
}
2137-
} elseif ('[' == $clientIp[0]) {
2137+
} elseif (0 === strpos($clientIp, '[')) {
21382138
// Strip brackets and :port from IPv6 addresses.
21392139
$i = strpos($clientIp, ']', 1);
21402140
$clientIps[$key] = $clientIp = substr($clientIp, 1, $i - 1);

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -900,7 +900,7 @@ public function getClientIpsForwardedProvider()
900900

901901
public function getClientIpsProvider()
902902
{
903-
// $expected $remoteAddr $httpForwardedFor $trustedProxies
903+
// $expected $remoteAddr $httpForwardedFor $trustedProxies
904904
return array(
905905
// simple IPv4
906906
array(array('88.88.88.88'), '88.88.88.88', null, null),
@@ -914,8 +914,8 @@ public function getClientIpsProvider()
914914

915915
// forwarded for with remote IPv4 addr not trusted
916916
array(array('127.0.0.1'), '127.0.0.1', '88.88.88.88', null),
917-
// forwarded for with remote IPv4 addr trusted
918-
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1')),
917+
// forwarded for with remote IPv4 addr trusted + comma
918+
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88,', array('127.0.0.1')),
919919
// forwarded for with remote IPv4 and all FF addrs trusted
920920
array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88', array('127.0.0.1', '88.88.88.88')),
921921
// forwarded for with remote IPv4 range trusted

‎src/Symfony/Component/HttpKernel/HttpCache/SubRequestHandler.php

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ public static function handle(HttpKernelInterface $kernel, Request $request, $ty
5757
foreach ($trustedHeaders as $key => $name) {
5858
if ($trustedHeaderSet & $key) {
5959
$request->headers->remove($name);
60+
$request->server->remove('HTTP_'.strtoupper(str_replace('-', '_', $name)));
6061
}
6162
}
6263
}
@@ -76,13 +77,16 @@ public static function handle(HttpKernelInterface $kernel, Request $request, $ty
7677
// set trusted values, reusing as much as possible the global trusted settings
7778
if (Request::HEADER_FORWARDED & $trustedHeaderSet) {
7879
$trustedValues[0] .= sprintf(';host="%s";proto=%s', $request->getHttpHost(), $request->getScheme());
79-
$request->headers->set($trustedHeaders[Request::HEADER_FORWARDED], implode(', ', $trustedValues));
80+
$request->headers->set($name = $trustedHeaders[Request::HEADER_FORWARDED], $v = implode(', ', $trustedValues));
81+
$request->server->set('HTTP_'.strtoupper(str_replace('-', '_', $name)), $v);
8082
}
8183
if (Request::HEADER_X_FORWARDED_FOR & $trustedHeaderSet) {
82-
$request->headers->set($trustedHeaders[Request::HEADER_X_FORWARDED_FOR], implode(', ', $trustedIps));
84+
$request->headers->set($name = $trustedHeaders[Request::HEADER_X_FORWARDED_FOR], $v = implode(', ', $trustedIps));
85+
$request->server->set('HTTP_'.strtoupper(str_replace('-', '_', $name)), $v);
8386
} elseif (!(Request::HEADER_FORWARDED & $trustedHeaderSet)) {
8487
Request::setTrustedProxies($trustedProxies, $trustedHeaderSet | Request::HEADER_X_FORWARDED_FOR);
85-
$request->headers->set($trustedHeaders[Request::HEADER_X_FORWARDED_FOR], implode(', ', $trustedIps));
88+
$request->headers->set($name = $trustedHeaders[Request::HEADER_X_FORWARDED_FOR], $v = implode(', ', $trustedIps));
89+
$request->server->set('HTTP_'.strtoupper(str_replace('-', '_', $name)), $v);
8690
}
8791

8892
// fix the client IP address by setting it to 127.0.0.1,

‎src/Symfony/Component/HttpKernel/Tests/Fragment/InlineFragmentRendererTest.php

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,8 @@ public function testRenderWithObjectsAsAttributes()
4747
$subRequest->attributes->replace(array('object' => $object, '_format' => 'html', '_controller' => 'main_controller', '_locale' => 'en'));
4848
$subRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
4949
$subRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
50+
$subRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
51+
$subRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
5052

5153
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($subRequest));
5254

@@ -101,6 +103,7 @@ public function testRenderWithTrustedHeaderDisabled()
101103

102104
$expectedSubRequest = Request::create('/');
103105
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
106+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
104107

105108
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
106109
$this->assertSame('foo', $strategy->render('/', Request::create('/'))->getContent());
@@ -193,8 +196,10 @@ public function testESIHeaderIsKeptInSubrequest()
193196

194197
if (Request::HEADER_X_FORWARDED_FOR & Request::getTrustedHeaderSet()) {
195198
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
199+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
196200
}
197201
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
202+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
198203

199204
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
200205

@@ -217,6 +222,8 @@ public function testHeadersPossiblyResultingIn304AreNotAssignedToSubrequest()
217222
$expectedSubRequest = Request::create('/');
218223
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
219224
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
225+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
226+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
220227

221228
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
222229
$request = Request::create('/', 'GET', array(), array(), array(), array('HTTP_IF_MODIFIED_SINCE' => 'Fri, 01 Jan 2016 00:00:00 GMT', 'HTTP_IF_NONE_MATCH' => '*'));
@@ -232,6 +239,8 @@ public function testFirstTrustedProxyIsSetAsRemote()
232239
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
233240
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
234241
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
242+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
243+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
235244

236245
$strategy = new InlineFragmentRenderer($this->getKernelExpectingRequest($expectedSubRequest));
237246

@@ -249,6 +258,8 @@ public function testIpAddressOfRangedTrustedProxyIsSetAsRemote()
249258
$expectedSubRequest->server->set('REMOTE_ADDR', '127.0.0.1');
250259
$expectedSubRequest->headers->set('x-forwarded-for', array('127.0.0.1'));
251260
$expectedSubRequest->headers->set('forwarded', array('for="127.0.0.1";host="localhost";proto=http'));
261+
$expectedSubRequest->server->set('HTTP_X_FORWARDED_FOR', '127.0.0.1');
262+
$expectedSubRequest->server->set('HTTP_FORWARDED', 'for="127.0.0.1";host="localhost";proto=http');
252263

253264
Request::setTrustedProxies(array('1.1.1.1/24'), -1);
254265

0 commit comments

Comments
 (0)