Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change ActionDispatch::RemoteIp to not use HTTP_X_FORWARDED_FOR when REMOTE_ADDR is not a trusted proxy #51610

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −6
Open

Change ActionDispatch::RemoteIp to not use HTTP_X_FORWARDED_FOR when REMOTE_ADDR is not a trusted proxy #51610

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions actionpack/lib/action_dispatch/middleware/remote_ip.rb
View file
Open in desktop
Expand Up @@ -164,7 +164,7 @@ def calculate_ip

# If every single IP option is in the trusted list, return the IP that's
# furthest away
filter_proxies(ips + [remote_addr]).first || ips.last || remote_addr
filter_proxies([remote_addr] + ips).first || ips.last || remote_addr
end

# Memoizes the value returned by #calculate_ip and returns it for
Expand All @@ -191,7 +191,7 @@ def ips_from(header) # :doc:

def filter_proxies(ips) # :doc:
ips.reject do |ip|
@proxies.any? { |proxy| proxy === ip }
ip.blank? || @proxies.any? { |proxy| proxy === ip }
end
end
end
Expand Down
4 changes: 2 additions & 2 deletions actionpack/test/dispatch/request_test.rb
View file
Open in desktop
Expand Up @@ -74,7 +74,7 @@ class RequestIP < BaseRequestTest

request = stub_request "REMOTE_ADDR" => "1.2.3.4",
"HTTP_X_FORWARDED_FOR" => "3.4.5.6"
assert_equal "3.4.5.6", request.remote_ip
assert_equal "1.2.3.4", request.remote_ip

request = stub_request "REMOTE_ADDR" => "127.0.0.1",
"HTTP_X_FORWARDED_FOR" => "3.4.5.6"
Expand Down Expand Up @@ -155,7 +155,7 @@ class RequestIP < BaseRequestTest

request = stub_request "REMOTE_ADDR" => "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
"HTTP_X_FORWARDED_FOR" => "fe80:0000:0000:0000:0202:b3ff:fe1e:8329"
assert_equal "fe80:0000:0000:0000:0202:b3ff:fe1e:8329", request.remote_ip
assert_equal "2001:0db8:85a3:0000:0000:8a2e:0370:7334", request.remote_ip

request = stub_request "REMOTE_ADDR" => "::1",
"HTTP_X_FORWARDED_FOR" => "fe80:0000:0000:0000:0202:b3ff:fe1e:8329"
Expand Down
9 changes: 7 additions & 2 deletions railties/test/application/middleware/remote_ip_test.rb
View file
Open in desktop
Expand Up @@ -60,7 +60,12 @@ def remote_ip(env = {})

test "remote_ip works with HTTP_X_FORWARDED_FOR" do
make_basic_app
assert_equal "4.2.42.42", remote_ip("REMOTE_ADDR" => "1.1.1.1", "HTTP_X_FORWARDED_FOR" => "4.2.42.42")
assert_equal "4.2.42.42", remote_ip("REMOTE_ADDR" => "10.0.1.1", "HTTP_X_FORWARDED_FOR" => "4.2.42.42")
end

test "remote_ip does not trust HTTP_X_FORWARDED_FOR for untrusted REMOTE_ADDR" do
make_basic_app
assert_equal "4.2.42.1", remote_ip("REMOTE_ADDR" => "4.2.42.1", "HTTP_X_FORWARDED_FOR" => "4.2.42.42")
end

test "the user can set trusted proxies with an enumerable of case equality comparable values" do
Expand All @@ -80,7 +85,7 @@ def remote_ip(env = {})
end

assert_equal "10.0.0.0",
remote_ip("REMOTE_ADDR" => "1.1.1.1", "HTTP_X_FORWARDED_FOR" => "10.0.0.0,4.2.42.42")
remote_ip("REMOTE_ADDR" => "4.2.42.1", "HTTP_X_FORWARDED_FOR" => "10.0.0.0,4.2.42.42")
end

test "setting trusted proxies to a single value (deprecated) adds value to default trusted proxies" do
Expand Down