Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[HttpFoundation] IpUtils checkIpv4 and checkIp6 use same cache #49749

Closed
@danielburger1337

Description

@danielburger1337

Symfony version(s) affected

5.4.* and 6.2.*

Description

Because IpUtils::checkIp4 and checkIp6 generate the same cache key, an IpV4 address is getting reported as invalid when it is first checked via the checkIp6 method and then with the checkIp4 method again (same applies for v6 getting checked by v4 method).

How to reproduce

use Symfony\Component\HttpFoundation\IpUtils;

$requestIp = '127.0.0.1';
$subnet = '127.0.0.1/8';

$isV4 = IpUtils::checkIp4($requestIp, $subnet);
$isV6 = IpUtils::checkIp6($requestIp, $subnet);

var_dump([
    'isV4' => $isV4, // true
    'isV6' => $isV6, // true
]);

but when called in reverse:

use Symfony\Component\HttpFoundation\IpUtils;

$requestIp = '127.0.0.1';
$subnet = '127.0.0.1/8';

$isV6 = IpUtils::checkIp6($requestIp, $subnet);
$isV4 = IpUtils::checkIp4($requestIp, $subnet);

var_dump([
    'isV4' => $isV4, // false
    'isV6' => $isV6, // false
]);

Possible Solution

The simplest solution is to change how the cache key is computed and add a "-v4" and "-v6" suffix.

public static function checkIp4(string $requestIp, string $ip): bool
{
$cacheKey = $requestIp.'-'.$ip;
if (isset(self::$checkedIps[$cacheKey])) {
return self::$checkedIps[$cacheKey];
}

public static function checkIp6(string $requestIp, string $ip): bool
{
$cacheKey = $requestIp.'-'.$ip;
if (isset(self::$checkedIps[$cacheKey])) {
return self::$checkedIps[$cacheKey];
}

Additional Context

This problem does not occur when the user uses the generic IpUtils::checkIp method. This is because it only checks v4 and v6 with their respective methods.

If someone can confirm that I did not make a mistake and this is a real bug, I will submit a PR ASAP. Please confirm which branch the PR should be based from.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions