nette / http / 29305851508

83%

master: 83%

push

github

RequestFactory: fixes client spoofing in trusted-proxy forwarding (security)

Backport of the proxy-resolution hardening to the 3.3 branch, without the
new configuration API.

The "Forwarded" branch trusted the leftmost "for" element, which a client can
forge by appending its own; it also merged the ',' and ';' separators with
preg_split, losing the hop structure. Both branches could return a non-IP
string from getRemoteAddress().

- Forwarded is now parsed per hop (RFC 7239): elements by ',', params by ';'.
- The client is the rightmost untrusted hop after stripping trailing trusted
  proxies (shared findClientHop()), not the spoofable leftmost one.
- host/proto are taken from the same hop as the client "for".
- The resolved address is validated as an IP; an obfuscated/invalid value or a
  fully trusted chain now yields null instead of a non-IP string.

BC: getRemoteAddress() returns null (not a non-IP string) when the innermost
forwarded value is not a valid IP; a Forwarded header carrying only proto/host
without a valid "for" no longer sets the scheme/host.

38 of 39 new or added lines in 1 file covered. (97.44%)

932 of 1119 relevant lines covered (83.29%)

0.83 hits per line