fix ReDoS
This commit is contained in:
parent
9031a4449b
commit
580b271775
|
@ -13,9 +13,11 @@ module Rack
|
||||||
|
|
||||||
def accepts?(env)
|
def accepts?(env)
|
||||||
return true unless env.include? 'HTTP_X_FORWARDED_FOR'
|
return true unless env.include? 'HTTP_X_FORWARDED_FOR'
|
||||||
ips = env['HTTP_X_FORWARDED_FOR'].split(/\s*,\s*/)
|
|
||||||
return false if env.include? 'HTTP_CLIENT_IP' and not ips.include? env['HTTP_CLIENT_IP']
|
ips = env['HTTP_X_FORWARDED_FOR'].split(',').map(&:strip)
|
||||||
return false if env.include? 'HTTP_X_REAL_IP' and not ips.include? env['HTTP_X_REAL_IP']
|
return false if env.include?('HTTP_CLIENT_IP') && (!ips.include? env['HTTP_CLIENT_IP'])
|
||||||
|
return false if env.include?('HTTP_X_REAL_IP') && (!ips.include? env['HTTP_X_REAL_IP'])
|
||||||
|
|
||||||
true
|
true
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue