-
-
Notifications
You must be signed in to change notification settings - Fork 9.8k
Description
Symfony version(s) affected
5.4.* and 6.2.*
Description
Because IpUtils::checkIp4 and checkIp6 generate the same cache key, an IpV4 address is getting reported as invalid when it is first checked via the checkIp6 method and then with the checkIp4 method again (same applies for v6 getting checked by v4 method).
How to reproduce
use Symfony\Component\HttpFoundation\IpUtils;
$requestIp = '127.0.0.1';
$subnet = '127.0.0.1/8';
$isV4 = IpUtils::checkIp4($requestIp, $subnet);
$isV6 = IpUtils::checkIp6($requestIp, $subnet);
var_dump([
'isV4' => $isV4, // true
'isV6' => $isV6, // true
]);but when called in reverse:
use Symfony\Component\HttpFoundation\IpUtils;
$requestIp = '127.0.0.1';
$subnet = '127.0.0.1/8';
$isV6 = IpUtils::checkIp6($requestIp, $subnet);
$isV4 = IpUtils::checkIp4($requestIp, $subnet);
var_dump([
'isV4' => $isV4, // false
'isV6' => $isV6, // false
]);Possible Solution
The simplest solution is to change how the cache key is computed and add a "-v4" and "-v6" suffix.
symfony/src/Symfony/Component/HttpFoundation/IpUtils.php
Lines 75 to 80 in 38b5992
| public static function checkIp4(string $requestIp, string $ip): bool | |
| { | |
| $cacheKey = $requestIp.'-'.$ip; | |
| if (isset(self::$checkedIps[$cacheKey])) { | |
| return self::$checkedIps[$cacheKey]; | |
| } |
symfony/src/Symfony/Component/HttpFoundation/IpUtils.php
Lines 120 to 125 in 38b5992
| public static function checkIp6(string $requestIp, string $ip): bool | |
| { | |
| $cacheKey = $requestIp.'-'.$ip; | |
| if (isset(self::$checkedIps[$cacheKey])) { | |
| return self::$checkedIps[$cacheKey]; | |
| } |
Additional Context
This problem does not occur when the user uses the generic IpUtils::checkIp method. This is because it only checks v4 and v6 with their respective methods.
If someone can confirm that I did not make a mistake and this is a real bug, I will submit a PR ASAP. Please confirm which branch the PR should be based from.