diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feature #33574 [Http][DI] Replace REMOTE_ADDR in trusted proxies with the current REMOTE_ADDR (mcfedr)

Browse Source 
This PR was merged into the 4.4 branch.

Discussion
----------

[Http][DI] Replace REMOTE_ADDR in trusted proxies with the current REMOTE_ADDR

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| License       | MIT
| Doc PR        |

Currently handling trusted ips when deploying behind some CDNs/Load balancers such as ELB is difficult because they dont have a constant IP address, its possible to overcome this as is suggested by the docs - https://symfony.com/doc/current/deployment/proxies.html#but-what-if-the-ip-of-my-reverse-proxy-changes-constantly - by settings trusted proxies to `$request->server->get('REMOTE_ADDR')` - but this has to be done in code, and so becomes dangerous if you code is deployed in different environments.

This change would allow the developer to stick to providing the envvar `TRUSTED_PROXIES`, and in the environment behind a ELB set the value to the literal string `REMOTE_ADDR`, and have it replaced at run time. This way in environments that are not using ELB his app is kept safe.

I think doing this replacement in `Request:: setTrustedProxies` is the best place because it means this feature isn't exposed to other parts of the code that might call `Request::getTrustedProxies`.

Commits
-------

643c9ff257 Replace REMOTE_ADDR in trusted proxies with the current REMOTE_ADDR
This commit is contained in:
Fabien Potencier 2019-09-27 07:42:32 +02:00
commit 66f8f68e13
2 changed files with 30 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/Symfony/Component/HttpFoundation/Request.php
View File

@ -567,14 +567,22 @@ class Request
*
* You should only list the reverse proxies that you manage directly.
*
* @param array $proxies A list of trusted proxies
* @param array $proxies A list of trusted proxies, the string 'REMOTE_ADDR' will be replaced with $_SERVER['REMOTE_ADDR']
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, to set which headers to trust from your proxies
*
* @throws \InvalidArgumentException When $trustedHeaderSet is invalid
*/
public static function setTrustedProxies(array $proxies, int $trustedHeaderSet)
{
self::$trustedProxies = $proxies;
self::$trustedProxies = array_reduce($proxies, function ($proxies, $proxy) {
if ('REMOTE_ADDR' !== $proxy) {
$proxies[] = $proxy;
} elseif (isset($_SERVER['REMOTE_ADDR'])) {
$proxies[] = $_SERVER['REMOTE_ADDR'];
}
return $proxies;
}, []);
self::$trustedHeaderSet = $trustedHeaderSet;
}

20
src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
View File

@ -2324,6 +2324,26 @@ class RequestTest extends TestCase
$this->assertSame(80, $request->getPort());
}
/**
* @dataProvider trustedProxiesRemoteAddr
*/
public function testTrustedProxiesRemoteAddr($serverRemoteAddr, $trustedProxies, $result)
{
$_SERVER['REMOTE_ADDR'] = $serverRemoteAddr;
Request::setTrustedProxies($trustedProxies, Request::HEADER_X_FORWARDED_ALL);
$this->assertSame($result, Request::getTrustedProxies());
}
public function trustedProxiesRemoteAddr()
{
return [
['1.1.1.1', ['REMOTE_ADDR'], ['1.1.1.1']],
['1.1.1.1', ['REMOTE_ADDR', '2.2.2.2'], ['1.1.1.1', '2.2.2.2']],
[null, ['REMOTE_ADDR'], []],
[null, ['REMOTE_ADDR', '2.2.2.2'], ['2.2.2.2']],
];
}
}
class RequestContentProxy extends Request