summaryrefslogtreecommitdiff
path: root/spec
diff options
context:
space:
mode:
authorDJ Mountney <david@twkie.net>2016-06-27 12:43:28 -0700
committerDJ Mountney <david@twkie.net>2016-06-29 21:19:55 -0700
commit860785f00757a47e0e3ace973444ba5ad6d9c174 (patch)
treec978419a88720a0637b9497de73bb76b6deea84a /spec
parentb32a6add8fa602eb35648f3f4661df8b98d909cb (diff)
downloadgitlab-ce-860785f00757a47e0e3ace973444ba5ad6d9c174.tar.gz
Make Rack::Request use our trusted proxies when filtering IP addressesrack-request-trusted-proxies
This allows us to control the trusted proxies while deployed in a private network. Normally Rack::Request will trust all private IPs as trusted proxies, which can caue problems if your users are connection on you network via private IP ranges. Normally in a rails app this is handled by action_dispatch request, but rack_attack is specifically using the Rack::Request object instead.
Diffstat (limited to 'spec')
-rw-r--r--spec/initializers/trusted_proxies_spec.rb12
1 files changed, 8 insertions, 4 deletions
diff --git a/spec/initializers/trusted_proxies_spec.rb b/spec/initializers/trusted_proxies_spec.rb
index 4bb149f25ff..14c8df954a6 100644
--- a/spec/initializers/trusted_proxies_spec.rb
+++ b/spec/initializers/trusted_proxies_spec.rb
@@ -6,14 +6,16 @@ describe 'trusted_proxies', lib: true do
set_trusted_proxies([])
end
- it 'preserves private IPs as remote_ip' do
+ it 'preserves private IPs' do
request = stub_request('HTTP_X_FORWARDED_FOR' => '10.1.5.89')
expect(request.remote_ip).to eq('10.1.5.89')
+ expect(request.ip).to eq('10.1.5.89')
end
- it 'filters out localhost from remote_ip' do
+ it 'filters out localhost' do
request = stub_request('HTTP_X_FORWARDED_FOR' => '1.1.1.1, 10.1.5.89, 127.0.0.1')
expect(request.remote_ip).to eq('10.1.5.89')
+ expect(request.ip).to eq('10.1.5.89')
end
end
@@ -22,9 +24,10 @@ describe 'trusted_proxies', lib: true do
set_trusted_proxies([ "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16" ])
end
- it 'filters out private and local IPs from remote_ip' do
+ it 'filters out private and local IPs' do
request = stub_request('HTTP_X_FORWARDED_FOR' => '1.2.3.6, 1.1.1.1, 10.1.5.89, 127.0.0.1')
expect(request.remote_ip).to eq('1.1.1.1')
+ expect(request.ip).to eq('1.1.1.1')
end
end
@@ -33,9 +36,10 @@ describe 'trusted_proxies', lib: true do
set_trusted_proxies([ "60.98.25.47" ])
end
- it 'filters out proxy IP from remote_ip' do
+ it 'filters out proxy IP' do
request = stub_request('HTTP_X_FORWARDED_FOR' => '1.2.3.6, 1.1.1.1, 60.98.25.47, 127.0.0.1')
expect(request.remote_ip).to eq('1.1.1.1')
+ expect(request.ip).to eq('1.1.1.1')
end
end