| 148 |
lars |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
/*
|
|
|
4 |
* This file is part of the Symfony package.
|
|
|
5 |
*
|
|
|
6 |
* (c) Fabien Potencier <fabien@symfony.com>
|
|
|
7 |
*
|
|
|
8 |
* For the full copyright and license information, please view the LICENSE
|
|
|
9 |
* file that was distributed with this source code.
|
|
|
10 |
*/
|
|
|
11 |
|
|
|
12 |
namespace Symfony\Component\HttpKernel\HttpCache;
|
|
|
13 |
|
|
|
14 |
use Symfony\Component\HttpFoundation\IpUtils;
|
|
|
15 |
use Symfony\Component\HttpFoundation\Request;
|
|
|
16 |
use Symfony\Component\HttpFoundation\Response;
|
|
|
17 |
use Symfony\Component\HttpKernel\HttpKernelInterface;
|
|
|
18 |
|
|
|
19 |
/**
|
|
|
20 |
* @author Nicolas Grekas <p@tchwork.com>
|
|
|
21 |
*
|
|
|
22 |
* @internal
|
|
|
23 |
*/
|
|
|
24 |
class SubRequestHandler
|
|
|
25 |
{
|
|
|
26 |
public static function handle(HttpKernelInterface $kernel, Request $request, int $type, bool $catch): Response
|
|
|
27 |
{
|
|
|
28 |
// save global state related to trusted headers and proxies
|
|
|
29 |
$trustedProxies = Request::getTrustedProxies();
|
|
|
30 |
$trustedHeaderSet = Request::getTrustedHeaderSet();
|
|
|
31 |
|
|
|
32 |
// remove untrusted values
|
|
|
33 |
$remoteAddr = $request->server->get('REMOTE_ADDR');
|
|
|
34 |
if (!$remoteAddr || !IpUtils::checkIp($remoteAddr, $trustedProxies)) {
|
|
|
35 |
$trustedHeaders = [
|
|
|
36 |
'FORWARDED' => $trustedHeaderSet & Request::HEADER_FORWARDED,
|
|
|
37 |
'X_FORWARDED_FOR' => $trustedHeaderSet & Request::HEADER_X_FORWARDED_FOR,
|
|
|
38 |
'X_FORWARDED_HOST' => $trustedHeaderSet & Request::HEADER_X_FORWARDED_HOST,
|
|
|
39 |
'X_FORWARDED_PROTO' => $trustedHeaderSet & Request::HEADER_X_FORWARDED_PROTO,
|
|
|
40 |
'X_FORWARDED_PORT' => $trustedHeaderSet & Request::HEADER_X_FORWARDED_PORT,
|
|
|
41 |
'X_FORWARDED_PREFIX' => $trustedHeaderSet & Request::HEADER_X_FORWARDED_PREFIX,
|
|
|
42 |
];
|
|
|
43 |
foreach (array_filter($trustedHeaders) as $name => $key) {
|
|
|
44 |
$request->headers->remove($name);
|
|
|
45 |
$request->server->remove('HTTP_'.$name);
|
|
|
46 |
}
|
|
|
47 |
}
|
|
|
48 |
|
|
|
49 |
// compute trusted values, taking any trusted proxies into account
|
|
|
50 |
$trustedIps = [];
|
|
|
51 |
$trustedValues = [];
|
|
|
52 |
foreach (array_reverse($request->getClientIps()) as $ip) {
|
|
|
53 |
$trustedIps[] = $ip;
|
|
|
54 |
$trustedValues[] = sprintf('for="%s"', $ip);
|
|
|
55 |
}
|
|
|
56 |
if ($ip !== $remoteAddr) {
|
|
|
57 |
$trustedIps[] = $remoteAddr;
|
|
|
58 |
$trustedValues[] = sprintf('for="%s"', $remoteAddr);
|
|
|
59 |
}
|
|
|
60 |
|
|
|
61 |
// set trusted values, reusing as much as possible the global trusted settings
|
|
|
62 |
if (Request::HEADER_FORWARDED & $trustedHeaderSet) {
|
|
|
63 |
$trustedValues[0] .= sprintf(';host="%s";proto=%s', $request->getHttpHost(), $request->getScheme());
|
|
|
64 |
$request->headers->set('Forwarded', $v = implode(', ', $trustedValues));
|
|
|
65 |
$request->server->set('HTTP_FORWARDED', $v);
|
|
|
66 |
}
|
|
|
67 |
if (Request::HEADER_X_FORWARDED_FOR & $trustedHeaderSet) {
|
|
|
68 |
$request->headers->set('X-Forwarded-For', $v = implode(', ', $trustedIps));
|
|
|
69 |
$request->server->set('HTTP_X_FORWARDED_FOR', $v);
|
|
|
70 |
} elseif (!(Request::HEADER_FORWARDED & $trustedHeaderSet)) {
|
|
|
71 |
Request::setTrustedProxies($trustedProxies, $trustedHeaderSet | Request::HEADER_X_FORWARDED_FOR);
|
|
|
72 |
$request->headers->set('X-Forwarded-For', $v = implode(', ', $trustedIps));
|
|
|
73 |
$request->server->set('HTTP_X_FORWARDED_FOR', $v);
|
|
|
74 |
}
|
|
|
75 |
|
|
|
76 |
// fix the client IP address by setting it to 127.0.0.1,
|
|
|
77 |
// which is the core responsibility of this method
|
|
|
78 |
$request->server->set('REMOTE_ADDR', '127.0.0.1');
|
|
|
79 |
|
|
|
80 |
// ensure 127.0.0.1 is set as trusted proxy
|
|
|
81 |
if (!IpUtils::checkIp('127.0.0.1', $trustedProxies)) {
|
|
|
82 |
Request::setTrustedProxies(array_merge($trustedProxies, ['127.0.0.1']), Request::getTrustedHeaderSet());
|
|
|
83 |
}
|
|
|
84 |
|
|
|
85 |
try {
|
|
|
86 |
return $kernel->handle($request, $type, $catch);
|
|
|
87 |
} finally {
|
|
|
88 |
// restore global state
|
|
|
89 |
Request::setTrustedProxies($trustedProxies, $trustedHeaderSet);
|
|
|
90 |
}
|
|
|
91 |
}
|
|
|
92 |
}
|