Description
Symfony version(s) affected
5.4.* and 6.2.*
Description
Because IpUtils::checkIp4
and checkIp6
generate the same cache key, an IpV4 address is getting reported as invalid when it is first checked via the checkIp6
method and then with the checkIp4
method again (same applies for v6 getting checked by v4 method).
How to reproduce
use Symfony\Component\HttpFoundation\IpUtils;
$requestIp = '127.0.0.1';
$subnet = '127.0.0.1/8';
$isV4 = IpUtils::checkIp4($requestIp, $subnet);
$isV6 = IpUtils::checkIp6($requestIp, $subnet);
var_dump([
'isV4' => $isV4, // true
'isV6' => $isV6, // true
]);
but when called in reverse:
use Symfony\Component\HttpFoundation\IpUtils;
$requestIp = '127.0.0.1';
$subnet = '127.0.0.1/8';
$isV6 = IpUtils::checkIp6($requestIp, $subnet);
$isV4 = IpUtils::checkIp4($requestIp, $subnet);
var_dump([
'isV4' => $isV4, // false
'isV6' => $isV6, // false
]);
Possible Solution
The simplest solution is to change how the cache key is computed and add a "-v4" and "-v6" suffix.
symfony/src/Symfony/Component/HttpFoundation/IpUtils.php
Lines 75 to 80 in 38b5992
symfony/src/Symfony/Component/HttpFoundation/IpUtils.php
Lines 120 to 125 in 38b5992
Additional Context
This problem does not occur when the user uses the generic IpUtils::checkIp
method. This is because it only checks v4 and v6 with their respective methods.
If someone can confirm that I did not make a mistake and this is a real bug, I will submit a PR ASAP. Please confirm which branch the PR should be based from.