nette / http

83%

master: 83%

LAST BUILD ON BRANCH v3.3

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• master
• v3.0
• v3.0.6
• v3.0.7
• v3.1
• v3.1.1
• v3.1.2
• v3.1.3
• v3.1.4
• v3.1.5
• v3.1.6
• v3.1.7
• v3.1.8
• v3.2
• v3.2.0
• v3.2.0-RC
• v3.2.1
• v3.2.2
• v3.2.3
• v3.2.4
• v3.3
• v3.3.0
• v3.3.0-RC
• v3.3.1
• v3.3.2
• v3.3.3
• v3.3.4
• v3.4
• v3.4.0

Build # 29305851508

Build Type

push

github

Committed by dg

Commit Message

RequestFactory: fixes client spoofing in trusted-proxy forwarding (security)

Backport of the proxy-resolution hardening to the 3.3 branch, without the
new configuration API.

The "Forwarded" branch trusted the leftmost "for" element, which a client can
forge by appending its own; it also merged the ',' and ';' separators with
preg_split, losing the hop structure. Both branches could return a non-IP
string from getRemoteAddress().

- Forwarded is now parsed per hop (RFC 7239): elements by ',', params by ';'.
- The client is the rightmost untrusted hop after stripping trailing trusted
  proxies (shared findClientHop()), not the spoofable leftmost one.
- host/proto are taken from the same hop as the client "for".
- The resolved address is validated as an IP; an obfuscated/invalid value or a
  fully trusted chain now yields null instead of a non-IP string.

BC: getRemoteAddress() returns null (not a non-IP string) when the innermost
forwarded value is not a valid IP; a Forwarded header carrying only proto/host
without a valid "for" no longer sets the scheme/host.

Coverage Stats

38 of 39 new or added lines in 1 file covered. (97.44%)

932 of 1119 relevant lines covered (83.29%)

0.83 hits per line