Ignore invalid trusted proxies in X-Forwarded-For header
Certain reverse proxies can send invalid IP addresses in the X-Forwarded-For header For example, Apache can send (null). Closes #20194
This commit is contained in:
parent
03738bdd48
commit
8d73c76131
|
@ -8,6 +8,7 @@ v 8.11.0 (unreleased)
|
||||||
- Add GitLab Workhorse version to admin dashboard (Katarzyna Kobierska Ula Budziszewska)
|
- Add GitLab Workhorse version to admin dashboard (Katarzyna Kobierska Ula Budziszewska)
|
||||||
|
|
||||||
v 8.10.1 (unreleased)
|
v 8.10.1 (unreleased)
|
||||||
|
- Ignore invalid trusted proxies in X-Forwarded-For header
|
||||||
- Fix bug where replies to commit notes displayed in the MR discussion tab wouldn't show up on the commit page
|
- Fix bug where replies to commit notes displayed in the MR discussion tab wouldn't show up on the commit page
|
||||||
|
|
||||||
v 8.10.0
|
v 8.10.0
|
||||||
|
|
|
@ -11,6 +11,12 @@ module Rack
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy|
|
||||||
|
begin
|
||||||
|
IPAddr.new(proxy)
|
||||||
|
rescue IPAddr::InvalidAddressError
|
||||||
|
end
|
||||||
|
end.compact
|
||||||
|
|
||||||
Rails.application.config.action_dispatch.trusted_proxies = (
|
Rails.application.config.action_dispatch.trusted_proxies = (
|
||||||
[ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies)
|
[ '127.0.0.1', '::1' ] + gitlab_trusted_proxies)
|
||||||
).map { |proxy| IPAddr.new(proxy) }
|
|
||||||
|
|
|
@ -17,6 +17,12 @@ describe 'trusted_proxies', lib: true do
|
||||||
expect(request.remote_ip).to eq('10.1.5.89')
|
expect(request.remote_ip).to eq('10.1.5.89')
|
||||||
expect(request.ip).to eq('10.1.5.89')
|
expect(request.ip).to eq('10.1.5.89')
|
||||||
end
|
end
|
||||||
|
|
||||||
|
it 'filters out bad values' do
|
||||||
|
request = stub_request('HTTP_X_FORWARDED_FOR' => '(null), 10.1.5.89')
|
||||||
|
expect(request.remote_ip).to eq('10.1.5.89')
|
||||||
|
expect(request.ip).to eq('10.1.5.89')
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
context 'with private IP ranges added' do
|
context 'with private IP ranges added' do
|
||||||
|
|
Loading…
Reference in New Issue