From 6578806fc3417675bd991362e7c1f05abdd1cb97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Tamarelle?= Date: Sun, 29 Nov 2015 00:02:58 +0100 Subject: [PATCH] [Request] Ignore invalid IP addresses sent by proxies Fixes symfony/symfony#15525 --- src/Symfony/Component/HttpFoundation/Request.php | 14 +++++++++++--- .../Component/HttpFoundation/Tests/RequestTest.php | 3 +++ 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php index d2af44626c..72bd9f1143 100644 --- a/src/Symfony/Component/HttpFoundation/Request.php +++ b/src/Symfony/Component/HttpFoundation/Request.php @@ -769,8 +769,7 @@ class Request $clientIps = array_map('trim', explode(',', $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_IP]))); $clientIps[] = $ip; // Complete the IP chain with the IP the request actually came from - - $ip = $clientIps[0]; // Fallback to this when the client IP falls into the range of trusted proxies + $firstTrustedIp = null; // Eliminate all IPs from the forwarded IP chain which are trusted proxies foreach ($clientIps as $key => $clientIp) { @@ -779,13 +778,22 @@ class Request $clientIps[$key] = $clientIp = $match[1]; } + if (!filter_var($clientIp, FILTER_VALIDATE_IP)) { + unset($clientIps[$key]); + } + if (IpUtils::checkIp($clientIp, self::$trustedProxies)) { unset($clientIps[$key]); + + // Fallback to this when the client IP falls into the range of trusted proxies + if (null === $firstTrustedIp) { + $firstTrustedIp = $clientIp; + } } } // Now the IP chain contains only untrusted proxies and the client IP - return $clientIps ? array_reverse($clientIps) : array($ip); + return $clientIps ? array_reverse($clientIps) : array($firstTrustedIp); } /** diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php index e17953819b..d601204231 100644 --- a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php +++ b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php @@ -863,6 +863,9 @@ class RequestTest extends \PHPUnit_Framework_TestCase // client IP with port array(array('88.88.88.88'), '127.0.0.1', '88.88.88.88:12345, 127.0.0.1', array('127.0.0.1')), + + // invalid forwarded IP is ignored + array(array('88.88.88.88'), '127.0.0.1', 'unknown,88.88.88.88', array('127.0.0.1')), ); }