From 8d73c7613178f5d46ff91a81f7783ca907deb64a Mon Sep 17 00:00:00 2001 From: Stan Hu Date: Sat, 23 Jul 2016 21:01:23 -0700 Subject: Ignore invalid trusted proxies in X-Forwarded-For header Certain reverse proxies can send invalid IP addresses in the X-Forwarded-For header For example, Apache can send (null). Closes #20194 --- config/initializers/trusted_proxies.rb | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'config') diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb index df4a933e22f..30770b71e24 100644 --- a/config/initializers/trusted_proxies.rb +++ b/config/initializers/trusted_proxies.rb @@ -11,6 +11,12 @@ module Rack end end +gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy| + begin + IPAddr.new(proxy) + rescue IPAddr::InvalidAddressError + end +end.compact + Rails.application.config.action_dispatch.trusted_proxies = ( - [ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies) -).map { |proxy| IPAddr.new(proxy) } + [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies) -- cgit v1.2.1