diff options
author | Rémy Coutable <remy@rymai.me> | 2016-07-25 10:33:12 +0200 |
---|---|---|
committer | Rémy Coutable <remy@rymai.me> | 2016-07-25 10:33:36 +0200 |
commit | d8e38de9694b69e9ad6cdaa1ba4dc0854c562a2f (patch) | |
tree | c34fc70220508b4a0186e2ef72b5bce93cf830fd | |
parent | 0030fe53818b7c3a56ce81fb05175879d0e47533 (diff) | |
parent | 8d73c7613178f5d46ff91a81f7783ca907deb64a (diff) | |
download | gitlab-ce-d8e38de9694b69e9ad6cdaa1ba4dc0854c562a2f.tar.gz |
Merge branch 'reject-invalid-trusted-proxies'
See !5454.
Signed-off-by: Rémy Coutable <remy@rymai.me>
-rw-r--r-- | CHANGELOG | 3 | ||||
-rw-r--r-- | config/initializers/trusted_proxies.rb | 10 | ||||
-rw-r--r-- | spec/initializers/trusted_proxies_spec.rb | 6 |
3 files changed, 16 insertions, 3 deletions
diff --git a/CHANGELOG b/CHANGELOG index 1dc1bdedf3f..c220926239a 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -8,8 +8,9 @@ v 8.11.0 (unreleased) - Add GitLab Workhorse version to admin dashboard (Katarzyna Kobierska Ula Budziszewska) v 8.10.1 (unreleased) - - Fix bug where replies to commit notes displayed in the MR discussion tab wouldn't show up on the commit page - Fix Error 500 when creating Wiki pages with hyphens or spaces + - Ignore invalid trusted proxies in X-Forwarded-For header + - Fix bug where replies to commit notes displayed in the MR discussion tab wouldn't show up on the commit page v 8.10.0 - Fix profile activity heatmap to show correct day name (eanplatter) diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb index df4a933e22f..30770b71e24 100644 --- a/config/initializers/trusted_proxies.rb +++ b/config/initializers/trusted_proxies.rb @@ -11,6 +11,12 @@ module Rack end end +gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy| + begin + IPAddr.new(proxy) + rescue IPAddr::InvalidAddressError + end +end.compact + Rails.application.config.action_dispatch.trusted_proxies = ( - [ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies) -).map { |proxy| IPAddr.new(proxy) } + [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies) diff --git a/spec/initializers/trusted_proxies_spec.rb b/spec/initializers/trusted_proxies_spec.rb index 14c8df954a6..52d5a7dffc9 100644 --- a/spec/initializers/trusted_proxies_spec.rb +++ b/spec/initializers/trusted_proxies_spec.rb @@ -17,6 +17,12 @@ describe 'trusted_proxies', lib: true do expect(request.remote_ip).to eq('10.1.5.89') expect(request.ip).to eq('10.1.5.89') end + + it 'filters out bad values' do + request = stub_request('HTTP_X_FORWARDED_FOR' => '(null), 10.1.5.89') + expect(request.remote_ip).to eq('10.1.5.89') + expect(request.ip).to eq('10.1.5.89') + end end context 'with private IP ranges added' do |