Skip to content

Commit 1fb519f

Browse files
nicolas-grekasnicolas-grekas
committed
[FrameworkBundle] allow configuring trusted proxies using semantic configuration
1 parent 56b993a commit 1fb519f

File tree

8 files changed

+66
-5
lines changed

8 files changed

+66
-5
lines changed

‎src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CHANGELOG
55
-----
66

77
* Added `framework.http_cache` configuration tree
8+
* Added `framework.trusted_proxies` and `framework.trusted_headers` configuration options
89

910
5.1.0
1011
-----

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,19 @@ public function getConfigTreeBuilder()
8585
->beforeNormalization()->ifString()->then(function ($v) { return [$v]; })->end()
8686
->prototype('scalar')->end()
8787
->end()
88+
->scalarNode('trusted_proxies')->end()
89+
->arrayNode('trusted_headers')
90+
->fixXmlConfig('trusted_header')
91+
->defaultValue(['x-forwarded-all', '!x-forwarded-host', '!x-forwarded-prefix'])
92+
->beforeNormalization()->ifString()->then(function ($v) { return $v ? array_map('trim', explode(',', $v)) : []; })->end()
93+
->enumPrototype()
94+
->values([
95+
'forwarded',
96+
'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port',
97+
'x-forwarded-all', '!x-forwarded-host', '!x-forwarded-prefix',
98+
])
99+
->end()
100+
->end()
88101
->scalarNode('error_controller')
89102
->defaultValue('error_controller')
90103
->end()

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@
6565
use Symfony\Component\Form\FormTypeGuesserInterface;
6666
use Symfony\Component\Form\FormTypeInterface;
6767
use Symfony\Component\HttpClient\ScopingHttpClient;
68+
use Symfony\Component\HttpFoundation\Request;
6869
use Symfony\Component\HttpKernel\CacheClearer\CacheClearerInterface;
6970
use Symfony\Component\HttpKernel\CacheWarmer\CacheWarmerInterface;
7071
use Symfony\Component\HttpKernel\Controller\ArgumentValueResolverInterface;
@@ -241,6 +242,11 @@ public function load(array $configs, ContainerBuilder $container)
241242
$container->setParameter('kernel.default_locale', $config['default_locale']);
242243
$container->setParameter('kernel.error_controller', $config['error_controller']);
243244

245+
if (isset($config['trusted_proxies'], $config['trusted_headers'])) {
246+
$container->setParameter('kernel.trusted_proxies', $config['trusted_proxies']);
247+
$container->setParameter('kernel.trusted_headers', $this->resolveTrustedHeaders($config['trusted_headers']));
248+
}
249+
244250
if (!$container->hasParameter('debug.file_link_format')) {
245251
$links = [
246252
'textmate' => 'txmt://open?url=file://%%f&line=%%l',
@@ -2096,6 +2102,30 @@ private function registerNotifierConfiguration(array $config, ContainerBuilder $
20962102
}
20972103
}
20982104

2105+
private function resolveTrustedHeaders(array $headers): int
2106+
{
2107+
$trustedHeaders = 0;
2108+
2109+
foreach ($headers as $h) {
2110+
switch ($h) {
2111+
case 'forwarded': $trustedHeaders |= Request::HEADER_FORWARDED; break;
2112+
case 'x-forwarded-for': $trustedHeaders |= Request::HEADER_X_FORWARDED_FOR; break;
2113+
case 'x-forwarded-host': $trustedHeaders |= Request::HEADER_X_FORWARDED_HOST; break;
2114+
case 'x-forwarded-proto': $trustedHeaders |= Request::HEADER_X_FORWARDED_PROTO; break;
2115+
case 'x-forwarded-port': $trustedHeaders |= Request::HEADER_X_FORWARDED_PORT; break;
2116+
case '!x-forwarded-host': $trustedHeaders &= ~Request::HEADER_X_FORWARDED_HOST; break;
2117+
case 'x-forwarded-all':
2118+
if (!\in_array('!x-forwarded-prefix', $headers)) {
2119+
throw new LogicException('When using "x-forwarded-all" in "framework.trusted_headers", "!x-forwarded-prefix" must be explicitly listed until support for X-Forwarded-Prefix is implemented.');
2120+
}
2121+
$trustedHeaders |= Request::HEADER_X_FORWARDED_ALL;
2122+
break;
2123+
}
2124+
}
2125+
2126+
return $trustedHeaders;
2127+
}
2128+
20992129
/**
21002130
* {@inheritdoc}
21012131
*/

‎src/Symfony/Bundle/FrameworkBundle/FrameworkBundle.php‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,6 @@ public function boot()
9595
if ($this->container->getParameter('kernel.http_method_override')) {
9696
Request::enableHttpMethodParameterOverride();
9797
}
98-
99-
if ($trustedHosts = $this->container->getParameter('kernel.trusted_hosts')) {
100-
Request::setTrustedHosts($trustedHosts);
101-
}
10298
}
10399

104100
public function build(ContainerBuilder $container)

‎src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,9 @@
4242
<xsd:attribute name="default-locale" type="xsd:string" />
4343
<xsd:attribute name="test" type="xsd:boolean" />
4444
<xsd:attribute name="error-controller" type="xsd:string" />
45+
<xsd:attribute name="trusted_hosts" type="xsd:string" />
46+
<xsd:attribute name="trusted_proxies" type="xsd:string" />
47+
<xsd:attribute name="trusted_headers" type="xsd:string" />
4548
</xsd:complexType>
4649

4750
<xsd:complexType name="form">

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
1919
use Symfony\Component\Config\Definition\Processor;
2020
use Symfony\Component\HttpClient\HttpClient;
21+
use Symfony\Component\HttpFoundation\Request;
2122
use Symfony\Component\Lock\Store\SemaphoreStore;
2223
use Symfony\Component\Mailer\Mailer;
2324
use Symfony\Component\Messenger\MessageBusInterface;
@@ -341,6 +342,11 @@ protected static function getBundleDefaultConfig()
341342
'http_method_override' => true,
342343
'ide' => null,
343344
'default_locale' => 'en',
345+
'trusted_headers' => [
346+
'x-forwarded-*',
347+
'!x-forwarded-host',
348+
'!x-forwarded-prefix',
349+
],
344350
'csrf_protection' => [
345351
'enabled' => false,
346352
],

‎src/Symfony/Component/HttpKernel/CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ CHANGELOG
55
-----
66

77
* made the public `http_cache` service handle requests when available
8+
* allowed enabling trusted hosts and proxies using new `kernel.trusted_hosts`,
9+
`kernel.trusted_proxies` and `kernel.trusted_headers` parameters
810

911
5.1.0
1012
-----

‎src/Symfony/Component/HttpKernel/Kernel.php‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -764,7 +764,17 @@ private function preBoot(): ContainerInterface
764764
$this->initializeBundles();
765765
$this->initializeContainer();
766766

767-
return $this->container;
767+
$container = $this->container;
768+
769+
if ($container->hasParameter('kernel.trusted_hosts') && $trustedHosts = $container->getParameter('kernel.trusted_hosts')) {
770+
Request::setTrustedHosts($trustedHosts);
771+
}
772+
773+
if ($container->hasParameter('kernel.trusted_proxies') && $container->hasParameter('kernel.trusted_headers') && $trustedProxies = $container->getParameter('kernel.trusted_proxies')) {
774+
Request::setTrustedProxies(explode(',', $trustedProxies), $container->getParameter('kernel.trusted_headers'));
775+
}
776+
777+
return $container;
768778
}
769779

770780
/**

0 commit comments

Comments
 (0)