[HttpFoundation] reintroduce set trusted header name in request

brambaud · brambaud · commit d9c3cf4e389d · 2019-08-05T20:57:39.000+02:00
diff --git a/src/Symfony/Component/HttpFoundation/CHANGELOG.md b/src/Symfony/Component/HttpFoundation/CHANGELOG.md
@@ -6,6 +6,7 @@ CHANGELOG
 
  * passing arguments to `Request::isMethodSafe()` is deprecated.
  * `ApacheRequest` is deprecated, use the `Request` class instead.
+ * added `setTrustedHeaderName()` method to the `Request` class.
 
 4.3.0
 -----
diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php
@@ -610,6 +610,23 @@ public static function setTrustedHosts(array $hostPatterns)
         self::$trustedHosts = [];
     }
 
+    /**
+     * Sets the name for trusted headers.
+     *
+     * @param int    $type  A bit field like Request::HEADER_*, to set which headers to trust from your proxies
+     * @param string $value The header name
+     *
+     * @throws \InvalidArgumentException
+     */
+    public static function setTrustedHeaderName(int $type, string $value): void
+    {
+        if (!isset(self::$trustedHeaders[$type])) {
+            throw new \InvalidArgumentException(sprintf('Unable to set the trusted header name for type "%s".', $type));
+        }
+
+        self::$trustedHeaders[$type] = $value;
+    }
+
     /**
      * Gets the list of trusted host patterns.
      *
diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
@@ -2325,6 +2325,20 @@ public function testTrustedPortDoesNotDefaultToZero()
 
         $this->assertSame(80, $request->getPort());
     }
+
+    public function testSetTrustedHeaderName()
+    {
+        $request = Request::create('http://example.com/');
+        $request->server->set('REMOTE_ADDR', '1.1.1.1');
+        $request->headers->set('X_CUSTOM_FORWARDED_PORT', '8888');
+
+        $this->assertSame(80, $request->getPort());
+
+        $request::setTrustedHeaderName(Request::HEADER_X_FORWARDED_PORT, 'X_CUSTOM_FORWARDED_PORT');
+        Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_PORT);
+
+        $this->assertSame(8888, $request->getPort());
+    }
 }
 
 class RequestContentProxy extends Request
