[FrameworkBundle] allow configuring trusted proxies using semantic configuration

nicolas-grekas · nicolas-grekas · commit f9606197c97f · 2020-06-19T16:53:36.000+02:00
diff --git a/src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md b/src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md
@@ -5,6 +5,7 @@ CHANGELOG
 -----
 
  * Added `framework.http_cache` configuration tree
+ * Added `framework.trusted_proxies` and `framework.trusted_headers` configuration options
 
 5.1.0
 -----
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -24,6 +24,7 @@
 use Symfony\Component\Form\Form;
 use Symfony\Component\HttpClient\HttpClient;
 use Symfony\Component\HttpFoundation\Cookie;
+use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\Lock\Lock;
 use Symfony\Component\Lock\Store\SemaphoreStore;
 use Symfony\Component\Mailer\Mailer;
@@ -85,6 +86,8 @@ public function getConfigTreeBuilder()
                     ->beforeNormalization()->ifString()->then(function ($v) { return [$v]; })->end()
                     ->prototype('scalar')->end()
                 ->end()
+                ->scalarNode('trusted_proxies')->end()
+                ->integerNode('trusted_headers')->defaultValue(Request::HEADER_X_FORWARDED_ALL ^ Request::HEADER_X_FORWARDED_HOST)->end()
                 ->scalarNode('error_controller')
                     ->defaultValue('error_controller')
                 ->end()
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -241,6 +241,11 @@ public function load(array $configs, ContainerBuilder $container)
         $container->setParameter('kernel.default_locale', $config['default_locale']);
         $container->setParameter('kernel.error_controller', $config['error_controller']);
 
+        if (isset($config['trusted_proxies'], $config['trusted_headers'])) {
+            $container->setParameter('kernel.trusted_proxies', $config['trusted_proxies']);
+            $container->setParameter('kernel.trusted_headers', $config['trusted_headers']);
+        }
+
         if (!$container->hasParameter('debug.file_link_format')) {
             $links = [
                 'textmate' => 'txmt://open?url=file://%%f&line=%%l',
diff --git a/src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php b/src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php
@@ -95,10 +95,6 @@ public function boot()
         if ($this->container->getParameter('kernel.http_method_override')) {
             Request::enableHttpMethodParameterOverride();
         }
-
-        if ($trustedHosts = $this->container->getParameter('kernel.trusted_hosts')) {
-            Request::setTrustedHosts($trustedHosts);
-        }
     }
 
     public function build(ContainerBuilder $container)
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
@@ -18,6 +18,7 @@
 use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
 use Symfony\Component\Config\Definition\Processor;
 use Symfony\Component\HttpClient\HttpClient;
+use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\Lock\Store\SemaphoreStore;
 use Symfony\Component\Mailer\Mailer;
 use Symfony\Component\Messenger\MessageBusInterface;
@@ -341,6 +342,7 @@ protected static function getBundleDefaultConfig()
             'http_method_override' => true,
             'ide' => null,
             'default_locale' => 'en',
+            'trusted_headers' => Request::HEADER_X_FORWARDED_ALL ^ Request::HEADER_X_FORWARDED_HOST,
             'csrf_protection' => [
                 'enabled' => false,
             ],
diff --git a/src/Symfony/Component/HttpKernel/CHANGELOG.md b/src/Symfony/Component/HttpKernel/CHANGELOG.md
@@ -5,6 +5,8 @@ CHANGELOG
 -----
 
  * made the public `http_cache` service handle requests when available
+ * allowed enabling trusted hosts and proxies using new `kernel.trusted_hosts`,
+   `kernel.trusted_proxies` and `kernel.trusted_headers` parameters
 
 5.1.0
 -----
diff --git a/src/Symfony/Component/HttpKernel/Kernel.php b/src/Symfony/Component/HttpKernel/Kernel.php
@@ -764,7 +764,17 @@ private function preBoot(): ContainerInterface
         $this->initializeBundles();
         $this->initializeContainer();
 
-        return $this->container;
+        $container = $this->container;
+
+        if ($container->hasParameter('kernel.trusted_hosts') && $trustedHosts = $container->getParameter('kernel.trusted_hosts')) {
+            Request::setTrustedHosts($trustedHosts);
+        }
+
+        if ($container->hasParameter('kernel.trusted_proxies') && $container->hasParameter('kernel.trusted_headers') && $trustedProxies = $container->getParameter('kernel.trusted_proxies')) {
+            Request::setTrustedProxies(explode(',', $trustedProxies), $container->getParameter('kernel.trusted_headers'));
+        }
+
+        return $container;
     }
 
     /**

Original file line number	Diff line number	Diff line change
`@@ -95,10 +95,6 @@ public function boot()`
`95`	`95`	`if ($this->container->getParameter('kernel.http_method_override')) {`
`96`	`96`	`Request::enableHttpMethodParameterOverride();`
`97`	`97`	`}`
`98`		`-`
`99`		`- if ($trustedHosts = $this->container->getParameter('kernel.trusted_hosts')) {`
`100`		`- Request::setTrustedHosts($trustedHosts);`
`101`		`- }`
`102`	`98`	`}`
`103`	`99`
`104`	`100`	`public function build(ContainerBuilder $container)`