Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork9.7k
[Request] Ignore invalid IP addresses sent by proxies#16736
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
This test case is modified, but returning something different that an IP address here looks broken.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
We already have this test case. See line above.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
There is no trusted proxy on the previous test.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Oh, you're right.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
wouldn't this now be able to returnarray(null) in some cases though ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
@GromNaN Any thoughts about this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
If the REMOTE_ADDR header contains an invalid IP address maybe.
fabpot commentedJan 25, 2016
Thank you@GromNaN. |
…mNaN)This PR was submitted for the 2.8 branch but it was merged into the 2.3 branch instead (closes#16736).Discussion----------[Request] Ignore invalid IP addresses sent by proxies| Q | A| ------------- | ---| Bug fix? | yes| New feature? | no| BC breaks? | ?| Deprecations? | no| Tests pass? | yes| Fixed tickets |#15525| License | MIT| Doc PR | n/aThe [RFC 7239](https://tools.ietf.org/html/rfc7239#section-6.2) allows other values that IP addresses to be passed in `Forwarded`header and [Nginx can add `unknown` to the `X-Forwarded-For`header](http://www.squid-cache.org/Doc/config/forwarded_for/).To prevent these invalid IP addresses from being returned as "Client IP", this PR ensure that they are excluded.Commits-------6578806 [Request] Ignore invalid IP addresses sent by proxies
TheRFC 7239 allows other values that IP addresses to be passed in
Forwardedheader andNginx can addunknownto theX-Forwarded-Forheader.To prevent these invalid IP addresses from being returned as "Client IP", this PR ensure that they are excluded.