Skip to content

Commit af9dd52

Browse files
nicolas-grekasnicolas-grekas
committed
[FrameworkBundle] allow configuring trusted proxies using semantic configuration
1 parent 2c9e9cd commit af9dd52

File tree

9 files changed

+72
-12
lines changed

9 files changed

+72
-12
lines changed

‎src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CHANGELOG
55
-----
66

77
* Added `framework.http_cache` configuration tree
8+
* Added `framework.trusted_proxies` and `framework.trusted_headers` configuration options
89

910
5.1.0
1011
-----

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,20 @@ public function getConfigTreeBuilder()
8585
->beforeNormalization()->ifString()->then(function ($v) { return [$v]; })->end()
8686
->prototype('scalar')->end()
8787
->end()
88+
->scalarNode('trusted_proxies')->end()
89+
->arrayNode('trusted_headers')
90+
->fixXmlConfig('trusted_header')
91+
->performNoDeepMerging()
92+
->defaultValue(['x-forwarded-all', '!x-forwarded-host', '!x-forwarded-prefix'])
93+
->beforeNormalization()->ifString()->then(function ($v) { return $v ? array_map('trim', explode(',', $v)) : []; })->end()
94+
->enumPrototype()
95+
->values([
96+
'forwarded',
97+
'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port',
98+
'x-forwarded-all', '!x-forwarded-host', '!x-forwarded-prefix',
99+
])
100+
->end()
101+
->end()
88102
->scalarNode('error_controller')
89103
->defaultValue('error_controller')
90104
->end()

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@
6565
use Symfony\Component\Form\FormTypeGuesserInterface;
6666
use Symfony\Component\Form\FormTypeInterface;
6767
use Symfony\Component\HttpClient\ScopingHttpClient;
68+
use Symfony\Component\HttpFoundation\Request;
6869
use Symfony\Component\HttpKernel\CacheClearer\CacheClearerInterface;
6970
use Symfony\Component\HttpKernel\CacheWarmer\CacheWarmerInterface;
7071
use Symfony\Component\HttpKernel\Controller\ArgumentValueResolverInterface;
@@ -242,6 +243,11 @@ public function load(array $configs, ContainerBuilder $container)
242243
$container->setParameter('kernel.default_locale', $config['default_locale']);
243244
$container->setParameter('kernel.error_controller', $config['error_controller']);
244245

246+
if (($config['trusted_proxies'] ?? false) && ($config['trusted_headers'] ?? false)) {
247+
$container->setParameter('kernel.trusted_proxies', $config['trusted_proxies']);
248+
$container->setParameter('kernel.trusted_headers', $this->resolveTrustedHeaders($config['trusted_headers']));
249+
}
250+
245251
if (!$container->hasParameter('debug.file_link_format')) {
246252
$links = [
247253
'textmate' => 'txmt://open?url=file://%%f&line=%%l',
@@ -2098,6 +2104,30 @@ private function registerNotifierConfiguration(array $config, ContainerBuilder $
20982104
}
20992105
}
21002106

2107+
private function resolveTrustedHeaders(array $headers): int
2108+
{
2109+
$trustedHeaders = 0;
2110+
2111+
foreach ($headers as $h) {
2112+
switch ($h) {
2113+
case 'forwarded': $trustedHeaders |= Request::HEADER_FORWARDED; break;
2114+
case 'x-forwarded-for': $trustedHeaders |= Request::HEADER_X_FORWARDED_FOR; break;
2115+
case 'x-forwarded-host': $trustedHeaders |= Request::HEADER_X_FORWARDED_HOST; break;
2116+
case 'x-forwarded-proto': $trustedHeaders |= Request::HEADER_X_FORWARDED_PROTO; break;
2117+
case 'x-forwarded-port': $trustedHeaders |= Request::HEADER_X_FORWARDED_PORT; break;
2118+
case '!x-forwarded-host': $trustedHeaders &= ~Request::HEADER_X_FORWARDED_HOST; break;
2119+
case 'x-forwarded-all':
2120+
if (!\in_array('!x-forwarded-prefix', $headers)) {
2121+
throw new LogicException('When using "x-forwarded-all" in "framework.trusted_headers", "!x-forwarded-prefix" must be explicitly listed until support for X-Forwarded-Prefix is implemented.');
2122+
}
2123+
$trustedHeaders |= Request::HEADER_X_FORWARDED_ALL;
2124+
break;
2125+
}
2126+
}
2127+
2128+
return $trustedHeaders;
2129+
}
2130+
21012131
/**
21022132
* {@inheritdoc}
21032133
*/

‎src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,6 @@ public function boot()
9595
if ($this->container->getParameter('kernel.http_method_override')) {
9696
Request::enableHttpMethodParameterOverride();
9797
}
98-
99-
if ($trustedHosts = $this->container->getParameter('kernel.trusted_hosts')) {
100-
Request::setTrustedHosts($trustedHosts);
101-
}
10298
}
10399

104100
public function build(ContainerBuilder $container)

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@
4242
<xsd:attribute name="default-locale" type="xsd:string" />
4343
<xsd:attribute name="test" type="xsd:boolean" />
4444
<xsd:attribute name="error-controller" type="xsd:string" />
45+
<xsd:attribute name="trusted_hosts" type="xsd:string" />
46+
<xsd:attribute name="trusted_proxies" type="xsd:string" />
47+
<xsd:attribute name="trusted_headers" type="xsd:string" />
4548
</xsd:complexType>
4649

4750
<xsd:complexType name="form">

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/services.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -132,9 +132,9 @@
132132
->tag('container.hot_path')
133133

134134
->set('http_cache.store', Store::class)
135-
->args([
136-
param('kernel.cache_dir').'/http_cache',
137-
])
135+
->args([
136+
param('kernel.cache_dir').'/http_cache',
137+
])
138138

139139
->set('url_helper', UrlHelper::class)
140140
->args([

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,7 @@ public function testDefaultConfig()
3030
$processor = new Processor();
3131
$config = $processor->processConfiguration(new Configuration(true), [['secret' => 's3cr3t']]);
3232

33-
$this->assertEquals(
34-
array_merge(['secret' => 's3cr3t', 'trusted_hosts' => []], self::getBundleDefaultConfig()),
35-
$config
36-
);
33+
$this->assertEquals(self::getBundleDefaultConfig(), $config);
3734
}
3835

3936
public function getTestValidSessionName()
@@ -341,6 +338,13 @@ protected static function getBundleDefaultConfig()
341338
'http_method_override' => true,
342339
'ide' => null,
343340
'default_locale' => 'en',
341+
'secret' => 's3cr3t',
342+
'trusted_hosts' => [],
343+
'trusted_headers' => [
344+
'x-forwarded-all',
345+
'!x-forwarded-host',
346+
'!x-forwarded-prefix',
347+
],
344348
'csrf_protection' => [
345349
'enabled' => false,
346350
],

‎src/Symfony/Component/HttpKernel/CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ CHANGELOG
55
-----
66

77
* made the public `http_cache` service handle requests when available
8+
* allowed enabling trusted hosts and proxies using new `kernel.trusted_hosts`,
9+
`kernel.trusted_proxies` and `kernel.trusted_headers` parameters
810

911
5.1.0
1012
-----

‎src/Symfony/Component/HttpKernel/Kernel.php

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -764,7 +764,17 @@ private function preBoot(): ContainerInterface
764764
$this->initializeBundles();
765765
$this->initializeContainer();
766766

767-
return $this->container;
767+
$container = $this->container;
768+
769+
if ($container->hasParameter('kernel.trusted_hosts') && $trustedHosts = $container->getParameter('kernel.trusted_hosts')) {
770+
Request::setTrustedHosts($trustedHosts);
771+
}
772+
773+
if ($container->hasParameter('kernel.trusted_proxies') && $container->hasParameter('kernel.trusted_headers') && $trustedProxies = $container->getParameter('kernel.trusted_proxies')) {
774+
Request::setTrustedProxies(\is_array($trustedProxies) ? $trustedProxies : array_map('trim', explode(',', $trustedProxies)), $container->getParameter('kernel.trusted_headers'));
775+
}
776+
777+
return $container;
768778
}
769779

770780
/**

0 commit comments

Comments
 (0)