Duncan Brown fbf1d82e0d Don’t ignore X-Forwarded-For IPs with ports attached ... Rack decided to tolerate proxies which choose to attach ports to X-Forwarded-For IPs by stripping the port: https://github.com/rack/rack/pull/1251. Attaching a port is rare in the wild but some proxies (notably Microsoft Azure's App Service) do it. Without this patch, remote_ip will ignore X-Forwarded-For IPs with ports attached and the return value is less likely to be useful. Rails should do the same thing. The stripping logic is already available in Rack::Request::Helpers, so change the X-Forwarded-For retrieval method from ActionDispatch::Request#x_forwarded_for (which returns the raw header) to #forwarded_for, which returns a stripped array of IP addresses, or nil. There may be other benefits hiding in Rack's implementation. We can't call ips_from with an array (and legislating for that inside ips_from doesn't appeal), so refactor out the bit we need to apply in both cases (verifying the IP is acceptable to IPAddr and that it's not a range) to a separate method called #sanitize_ips which reduces an array of maybe-ips to an array of acceptable ones.		2020-05-09 22:23:34 -04:00
..
abstract_controller	Dogfooding "active_support/core_ext/symbol/starts_ends_with"	2020-05-06 14:19:25 +09:00
action_controller	Remove deprecated force_ssl at the controller level.	2020-05-05 00:58:54 -04:00
action_dispatch	Don’t ignore X-Forwarded-For IPs with ports attached	2020-05-09 22:23:34 -04:00
action_pack
abstract_controller.rb
action_controller.rb	Remove deprecated force_ssl at the controller level.	2020-05-05 00:58:54 -04:00
action_dispatch.rb
action_pack.rb