Commit 1e8f2ccf authored by Rémy Coutable's avatar Rémy Coutable

Merge branch 'reject-invalid-trusted-proxies'

See !5454.
Signed-off-by: default avatarRémy Coutable <remy@rymai.me>
parent 7b5fb0ce
...@@ -6,6 +6,7 @@ v 8.10.1 (unreleased) ...@@ -6,6 +6,7 @@ v 8.10.1 (unreleased)
- Add detailed info on storage path mountpoints. !5437 - Add detailed info on storage path mountpoints. !5437
- Fix Error 500 when creating Wiki pages with hyphens or spaces. !5444 - Fix Error 500 when creating Wiki pages with hyphens or spaces. !5444
- Fix bug where replies to commit notes displayed in the MR discussion tab wouldn't show up on the commit page. !5446 - Fix bug where replies to commit notes displayed in the MR discussion tab wouldn't show up on the commit page. !5446
- Ignore invalid trusted proxies in X-Forwarded-For header. !5454
v 8.10.0 v 8.10.0
- Fix profile activity heatmap to show correct day name (eanplatter) - Fix profile activity heatmap to show correct day name (eanplatter)
......
...@@ -11,6 +11,12 @@ module Rack ...@@ -11,6 +11,12 @@ module Rack
end end
end end
gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy|
begin
IPAddr.new(proxy)
rescue IPAddr::InvalidAddressError
end
end.compact
Rails.application.config.action_dispatch.trusted_proxies = ( Rails.application.config.action_dispatch.trusted_proxies = (
[ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies) [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies)
).map { |proxy| IPAddr.new(proxy) }
...@@ -17,6 +17,12 @@ describe 'trusted_proxies', lib: true do ...@@ -17,6 +17,12 @@ describe 'trusted_proxies', lib: true do
expect(request.remote_ip).to eq('10.1.5.89') expect(request.remote_ip).to eq('10.1.5.89')
expect(request.ip).to eq('10.1.5.89') expect(request.ip).to eq('10.1.5.89')
end end
it 'filters out bad values' do
request = stub_request('HTTP_X_FORWARDED_FOR' => '(null), 10.1.5.89')
expect(request.remote_ip).to eq('10.1.5.89')
expect(request.ip).to eq('10.1.5.89')
end
end end
context 'with private IP ranges added' do context 'with private IP ranges added' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment