From ae108ff703a8b9e73f2a260806c89eccac5a6cf6 Mon Sep 17 00:00:00 2001 From: lookatmike Date: Sun, 31 Jul 2016 15:36:11 -0400 Subject: Ignore invalid IPs in X-Forwarded-For when trusted proxies are configured. --- CHANGELOG | 1 + config/initializers/trusted_proxies.rb | 2 ++ spec/initializers/trusted_proxies_spec.rb | 6 ++++++ 3 files changed, 9 insertions(+) diff --git a/CHANGELOG b/CHANGELOG index 9b66108c160..a0a3484d9a2 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -36,6 +36,7 @@ v 8.11.0 (unreleased) - Make error pages responsive (Takuya Noguchi) - Change requests_profiles resource constraint to catch virtually any file - Reduce number of queries made for merge_requests/:id/diffs + - Ignore invalid IPs in X-Forwarded-For when trusted proxies are configured. v 8.10.3 (unreleased) - Fix hooks missing on imported GitLab projects diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb index 30770b71e24..cd869657c53 100644 --- a/config/initializers/trusted_proxies.rb +++ b/config/initializers/trusted_proxies.rb @@ -7,6 +7,8 @@ module Rack class Request def trusted_proxy?(ip) Rails.application.config.action_dispatch.trusted_proxies.any? { |proxy| proxy === ip } + rescue IPAddr::InvalidAddressError + false end end end diff --git a/spec/initializers/trusted_proxies_spec.rb b/spec/initializers/trusted_proxies_spec.rb index 52d5a7dffc9..290e47763eb 100644 --- a/spec/initializers/trusted_proxies_spec.rb +++ b/spec/initializers/trusted_proxies_spec.rb @@ -47,6 +47,12 @@ describe 'trusted_proxies', lib: true do expect(request.remote_ip).to eq('1.1.1.1') expect(request.ip).to eq('1.1.1.1') end + + it 'handles invalid ip addresses' do + request = stub_request('HTTP_X_FORWARDED_FOR' => '(null), 1.1.1.1:12345, 1.1.1.1') + expect(request.remote_ip).to eq('1.1.1.1') + expect(request.ip).to eq('1.1.1.1') + end end def stub_request(headers = {}) -- cgit v1.2.1