Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 343490c

Browse files
fabpotfabpot
committed
feature #21830 [HttpFoundation] Add $trustedHeaderSet arg to Request::setTrustedProxies() - deprecate not setting it (nicolas-grekas)
This PR was merged into the 3.3-dev branch. Discussion ---------- [HttpFoundation] Add $trustedHeaderSet arg to Request::setTrustedProxies() - deprecate not setting it | Q | A | ------------- | --- | Branch? | master | Bug fix? | no | New feature? | yes | BC breaks? | no | Deprecations? | yes | Tests pass? | no tests yet | Fixed tickets | - | License | MIT | Doc PR | - Follow up of #18688 PR adds a second `$trustedHeaderSet` argument to `Request::setTrustedProxies()`, can be either `Request::HEADER_FORWARDED` or `Request::HEADER_X_FORWARDED_ALL` to set which header to trust from your proxies - the idea being that without this info, one will get some `ConflictingHeadersException`, but those may be lost in the logs. Commits ------- d3c9604 [HttpFoundation] Add $trustedHeaderSet arg to Request::setTrustedProxies() - deprecate not setting it
2 parents 3023e4b + d3c9604 commit 343490c

File tree

21 files changed

+243
-73
lines changed

21 files changed

+243
-73
lines changed

‎UPGRADE-3.3.md

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,9 @@ FrameworkBundle
126126
* The `cache:clear` command should always be called with the `--no-warmup` option.
127127
Warmup should be done via the `cache:warmup` command.
128128

129+
* The "framework.trusted_proxies" configuration option and the corresponding "kernel.trusted_proxies" parameter have been deprecated and will be removed in 4.0. Use the Request::setTrustedProxies() method in your front controller instead.
130+
131+
129132
* The `Symfony\Bundle\FrameworkBundle\DependencyInjection\Compiler\AddConsoleCommandPass` has been deprecated. Use `Symfony\Component\Console\DependencyInjection\AddConsoleCommandPass` instead.
130133

131134
* The `Symfony\Bundle\FrameworkBundle\DependencyInjection\Compiler\SerializerPass` class has been
@@ -175,14 +178,24 @@ FrameworkBundle
175178
class has been deprecated and will be removed in 4.0. Use the
176179
`Symfony\Component\Routing\DependencyInjection\RoutingResolverPass` class instead.
177180

178-
* The `server:run`, `server:start`, `server:stop` and
179-
`server:status` console commands have been moved to a dedicated bundle.
180-
Require `symfony/web-server-bundle` in your composer.json and register
181+
* The `server:run`, `server:start`, `server:stop` and
182+
`server:status` console commands have been moved to a dedicated bundle.
183+
Require `symfony/web-server-bundle` in your composer.json and register
181184
`Symfony\Bundle\WebServerBundle\WebServerBundle` in your AppKernel to use them.
182185

183186
* The `Symfony\Bundle\FrameworkBundle\Translation\Translator` constructor now takes the
184187
default locale as 3rd argument. Not passing it will trigger an error in 4.0.
185188

189+
HttpFoundation
190+
--------------
191+
192+
* The `Request::setTrustedProxies()` method takes a new `$trustedHeaderSet` argument - not setting it is deprecated.
193+
Set it to `Request::HEADER_FORWARDED` if your reverse-proxy uses the RFC7239 `Forwarded` header,
194+
or to `Request::HEADER_X_FORWARDED_ALL` if it is using `X-Forwarded-*` headers instead.
195+
196+
* The `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods are deprecated,
197+
use the RFC7239 `Forwarded` header, or the `X-Forwarded-*` headers instead.
198+
186199
HttpKernel
187200
-----------
188201

‎UPGRADE-4.0.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,8 @@ FrameworkBundle
190190
* The `cache:clear` command does not warmup the cache anymore. Warmup should
191191
be done via the `cache:warmup` command.
192192

193+
* The "framework.trusted_proxies" configuration option and the corresponding "kernel.trusted_proxies" parameter have been removed. Use the `Request::setTrustedProxies()` method in your front controller instead.
194+
193195
* Support for absolute template paths has been removed.
194196

195197
* The following form types registered as services have been removed; use their
@@ -280,6 +282,15 @@ FrameworkBundle
280282
HttpFoundation
281283
---------------
282284

285+
HttpFoundation
286+
--------------
287+
288+
* The `Request::setTrustedProxies()` method takes a new `$trustedHeaderSet` argument.
289+
Set it to `Request::HEADER_FORWARDED` if your reverse-proxy uses the RFC7239 `Forwarded` header,
290+
or to `Request::HEADER_X_FORWARDED_ALL` if it is using `X-Forwarded-*` headers instead.
291+
292+
* The `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods have been removed.
293+
283294
* Extending the following methods of `Response`
284295
is no longer possible (these methods are now `final`):
285296

‎src/Symfony/Bridge/Monolog/Tests/Processor/WebProcessorTest.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ public function testUsesRequestServerData()
3636

3737
public function testUseRequestClientIp()
3838
{
39-
Request::setTrustedProxies(array('192.168.0.1'));
39+
Request::setTrustedProxies(array('192.168.0.1'), Request::HEADER_X_FORWARDED_ALL);
4040
list($event, $server) = $this->createRequestEvent(array('X_FORWARDED_FOR' => '192.168.0.2'));
4141

4242
$processor = new WebProcessor();

‎src/Symfony/Bridge/Monolog/composer.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,9 @@
2525
"symfony/event-dispatcher": "~2.8|~3.0",
2626
"symfony/var-dumper": "~3.3"
2727
},
28+
"conflict": {
29+
"symfony/http-foundation": "<3.3"
30+
},
2831
"suggest": {
2932
"symfony/http-kernel": "For using the debugging handlers together with the response life cycle of the HTTP kernel.",
3033
"symfony/console": "For the possibility to show log messages in console commands depending on verbosity settings. You need version ~2.3 of the console for it.",

‎src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CHANGELOG
55
-----
66

77
* Deprecated `cache:clear` with warmup (always call it with `--no-warmup`)
8+
* Deprecated the "framework.trusted_proxies" configuration option and the corresponding "kernel.trusted_proxies" parameter
89
* Changed default configuration for
910
assets/forms/validation/translation/serialization/csrf from `canBeEnabled()` to
1011
`canBeDisabled()` when Flex is used

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Config\Definition\Builder\TreeBuilder;
1919
use Symfony\Component\Config\Definition\ConfigurationInterface;
2020
use Symfony\Component\Form\Form;
21+
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\Serializer\Serializer;
2223
use Symfony\Component\Translation\Translator;
2324
use Symfony\Component\Validator\Validation;
@@ -58,6 +59,14 @@ public function getConfigTreeBuilder()
5859
return $v;
5960
})
6061
->end()
62+
->beforeNormalization()
63+
->ifTrue(function ($v) { return isset($v['trusted_proxies']); })
64+
->then(function ($v) {
65+
@trigger_error('The "framework.trusted_proxies" configuration key is deprecated since version 3.3 and will be removed in 4.0. Use the Request::setTrustedProxies() method in your front controller instead.', E_USER_DEPRECATED);
66+
67+
return $v;
68+
})
69+
->end()
6170
->children()
6271
->scalarNode('secret')->end()
6372
->scalarNode('http_method_override')

‎src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,9 @@ public function boot()
6060
ErrorHandler::register(null, false)->throwAt($this->container->getParameter('debug.error_handler.throw_at'), true);
6161

6262
if ($trustedProxies = $this->container->getParameter('kernel.trusted_proxies')) {
63-
Request::setTrustedProxies($trustedProxies);
63+
@trigger_error('The "kernel.trusted_proxies" parameter is deprecated since version 3.3 and will be removed in 4.0. Use the Request::setTrustedProxies() method in your front controller instead.', E_USER_DEPRECATED);
64+
65+
Request::setTrustedProxies($trustedProxies, Request::getTrustedHeaderSet());
6466
}
6567

6668
if ($this->container->getParameter('kernel.http_method_override')) {

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ public function testDoNoDuplicateDefaultFormResources()
4343
}
4444

4545
/**
46+
* @group legacy
4647
* @dataProvider getTestValidTrustedProxiesData
4748
*/
4849
public function testValidTrustedProxies($trustedProxies, $processedProxies)
@@ -73,6 +74,7 @@ public function getTestValidTrustedProxiesData()
7374
}
7475

7576
/**
77+
* @group legacy
7678
* @expectedException \Symfony\Component\Config\Definition\Exception\InvalidConfigurationException
7779
*/
7880
public function testInvalidTypeTrustedProxies()
@@ -88,6 +90,7 @@ public function testInvalidTypeTrustedProxies()
8890
}
8991

9092
/**
93+
* @group legacy
9194
* @expectedException \Symfony\Component\Config\Definition\Exception\InvalidConfigurationException
9295
*/
9396
public function testInvalidValueTrustedProxies()

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
),
1111
),
1212
'http_method_override' => false,
13-
'trusted_proxies' => array('127.0.0.1', '10.0.0.1'),
1413
'esi' => array(
1514
'enabled' => true,
1615
),

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
77
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
88

9-
<framework:config secret="s3cr3t" ide="file%%link%%format" default-locale="fr" trusted-proxies="127.0.0.1, 10.0.0.1" http-method-override="false">
9+
<framework:config secret="s3cr3t" ide="file%%link%%format" default-locale="fr" http-method-override="false">
1010
<framework:csrf-protection />
1111
<framework:form>
1212
<framework:csrf-protection field-name="_csrf"/>

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/full.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ framework:
66
csrf_protection:
77
field_name: _csrf
88
http_method_override: false
9-
trusted_proxies: ['127.0.0.1', '10.0.0.1']
109
esi:
1110
enabled: true
1211
profiler:

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -119,13 +119,6 @@ public function testCsrfProtectionForFormsEnablesCsrfProtectionAutomatically()
119119
$this->assertTrue($container->hasDefinition('security.csrf.token_manager'));
120120
}
121121

122-
public function testProxies()
123-
{
124-
$container = $this->createContainerFromFile('full');
125-
126-
$this->assertEquals(array('127.0.0.1', '10.0.0.1'), $container->getParameter('kernel.trusted_proxies'));
127-
}
128-
129122
public function testHttpMethodOverride()
130123
{
131124
$container = $this->createContainerFromFile('full');

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ CHANGELOG
44
3.3.0
55
-----
66

7+
* added `$trustedHeaderSet` argument to `Request::setTrustedProxies()` - deprecate not setting it,
8+
* deprecated the `Request::setTrustedHeaderName()` and `Request::getTrustedHeaderName()` methods,
79
* added `File\Stream`, to be passed to `BinaryFileResponse` when the size of the served file is unknown,
810
disabling `Range` and `Content-Length` handling, switching to chunked encoding instead
911
* added the `Cookie::fromString()` method that allows to create a cookie from a

‎src/Symfony/Component/HttpFoundation/Request.php

Lines changed: 69 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,21 @@
3030
*/
3131
class Request
3232
{
33-
const HEADER_FORWARDED = 'forwarded';
34-
const HEADER_CLIENT_IP = 'client_ip';
35-
const HEADER_CLIENT_HOST = 'client_host';
36-
const HEADER_CLIENT_PROTO = 'client_proto';
37-
const HEADER_CLIENT_PORT = 'client_port';
33+
const HEADER_FORWARDED = 0b00001;
34+
const HEADER_X_FORWARDED_ALL = 0b11110;
35+
const HEADER_X_FORWARDED_FOR = 2;
36+
const HEADER_X_FORWARDED_HOST = 4;
37+
const HEADER_X_FORWARDED_PROTO = 8;
38+
const HEADER_X_FORWARDED_PORT = 16;
39+
40+
/** @deprecated since version 3.3, to be removed in 4.0 */
41+
const HEADER_CLIENT_IP = self::HEADER_X_FORWARDED_FOR;
42+
/** @deprecated since version 3.3, to be removed in 4.0 */
43+
const HEADER_CLIENT_HOST = self::HEADER_X_FORWARDED_HOST;
44+
/** @deprecated since version 3.3, to be removed in 4.0 */
45+
const HEADER_CLIENT_PROTO = self::HEADER_X_FORWARDED_PROTO;
46+
/** @deprecated since version 3.3, to be removed in 4.0 */
47+
const HEADER_CLIENT_PORT = self::HEADER_X_FORWARDED_PORT;
3848

3949
const METHOD_HEAD = 'HEAD';
4050
const METHOD_GET = 'GET';
@@ -70,6 +80,8 @@ class Request
7080
*
7181
* The other headers are non-standard, but widely used
7282
* by popular reverse proxies (like Apache mod_proxy or Amazon EC2).
83+
*
84+
* @deprecated since version 3.3, to be removed in 4.0
7385
*/
7486
protected static $trustedHeaders = array(
7587
self::HEADER_FORWARDED => 'FORWARDED',
@@ -210,6 +222,17 @@ class Request
210222
private $isHostValid = true;
211223
private $isClientIpsValid = true;
212224

225+
private static $trustedHeaderSet = -1;
226+
227+
/** @deprecated since version 3.3, to be removed in 4.0 */
228+
private static $trustedHeaderNames = array(
229+
self::HEADER_FORWARDED => 'FORWARDED',
230+
self::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',
231+
self::HEADER_CLIENT_HOST => 'X_FORWARDED_HOST',
232+
self::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',
233+
self::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',
234+
);
235+
213236
/**
214237
* Constructor.
215238
*
@@ -548,11 +571,26 @@ public function overrideGlobals()
548571
*
549572
* You should only list the reverse proxies that you manage directly.
550573
*
551-
* @param array $proxies A list of trusted proxies
574+
* @param array $proxies A list of trusted proxies
575+
* @param int $trustedHeaderSet A bit field of Request::HEADER_*, usually either Request::HEADER_FORWARDED or Request::HEADER_X_FORWARDED_ALL, to set which headers to trust from your proxies
576+
*
577+
* @throws \InvalidArgumentException When $trustedHeaderSet is invalid
552578
*/
553-
public static function setTrustedProxies(array $proxies)
579+
public static function setTrustedProxies(array $proxies/*, int $trustedHeaderSet*/)
554580
{
555581
self::$trustedProxies = $proxies;
582+
583+
if (2 > func_num_args()) {
584+
@trigger_error(sprintf('The %s() method expects a bit field of Request::HEADER_* as second argument. Not defining it is deprecated since version 3.3 and will be required in 4.0.', __METHOD__), E_USER_DEPRECATED);
585+
586+
return;
587+
}
588+
$trustedHeaderSet = func_get_arg(1);
589+
590+
foreach (self::$trustedHeaderNames as $header => $name) {
591+
self::$trustedHeaders[$header] = $header & $trustedHeaderSet ? $name : null;
592+
}
593+
self::$trustedHeaderSet = $trustedHeaderSet;
556594
}
557595

558596
/**
@@ -565,6 +603,16 @@ public static function getTrustedProxies()
565603
return self::$trustedProxies;
566604
}
567605

606+
/**
607+
* Gets the set of trusted headers from trusted proxies.
608+
*
609+
* @return int A bit field of Request::HEADER_* that defines which headers are trusted from your proxies
610+
*/
611+
public static function getTrustedHeaderSet()
612+
{
613+
return self::$trustedHeaderSet;
614+
}
615+
568616
/**
569617
* Sets a list of trusted host patterns.
570618
*
@@ -608,14 +656,22 @@ public static function getTrustedHosts()
608656
* @param string $value The header name
609657
*
610658
* @throws \InvalidArgumentException
659+
*
660+
* @deprecated since version 3.3, to be removed in 4.0. Use "X-Forwarded-*" headers or the "Forwarded" header defined in RFC7239, and the $trustedHeaderSet argument of the Request::setTrustedProxies() method instead.
611661
*/
612662
public static function setTrustedHeaderName($key, $value)
613663
{
664+
@trigger_error(sprintf('The "%s()" method is deprecated since version 3.3 and will be removed in 4.0. Use "X-Forwarded-*" headers or the "Forwarded" header defined in RFC7239, and the $trustedHeaderSet argument of the Request::setTrustedProxies() method instead.', __METHOD__), E_USER_DEPRECATED);
665+
614666
if (!array_key_exists($key, self::$trustedHeaders)) {
615667
throw new \InvalidArgumentException(sprintf('Unable to set the trusted header name for key "%s".', $key));
616668
}
617669

618670
self::$trustedHeaders[$key] = $value;
671+
672+
if (null !== $value) {
673+
self::$trustedHeaderNames[$key] = $value;
674+
}
619675
}
620676

621677
/**
@@ -626,9 +682,15 @@ public static function setTrustedHeaderName($key, $value)
626682
* @return string The header name
627683
*
628684
* @throws \InvalidArgumentException
685+
*
686+
* @deprecated since version 3.3, to be removed in 4.0. Use the Request::getTrustedHeaderSet() method instead.
629687
*/
630688
public static function getTrustedHeaderName($key)
631689
{
690+
if (2 > func_num_args() || func_get_arg(1)) {
691+
@trigger_error(sprintf('The "%s()" method is deprecated since version 3.3 and will be removed in 4.0. Use the Request::getTrustedHeaderSet() method instead.', __METHOD__), E_USER_DEPRECATED);
692+
}
693+
632694
if (!array_key_exists($key, self::$trustedHeaders)) {
633695
throw new \InvalidArgumentException(sprintf('Unable to get the trusted header name for key "%s".', $key));
634696
}

0 commit comments

Comments
 (0)