diff options
author | Stan Hu <stanhu@gmail.com> | 2016-07-24 07:01:23 +0300 |
---|---|---|
committer | Stan Hu <stanhu@gmail.com> | 2016-07-24 07:06:19 +0300 |
commit | 8d73c7613178f5d46ff91a81f7783ca907deb64a (patch) | |
tree | efdf5ed38e0d465b71127a09ed0e807f3b5b0cbb /config/initializers | |
parent | 03738bdd48d64e30c068df54eaf7e44d21e3c9fa (diff) |
Ignore invalid trusted proxies in X-Forwarded-For header
Certain reverse proxies can send invalid IP addresses in the X-Forwarded-For header
For example, Apache can send (null).
Closes #20194
Diffstat (limited to 'config/initializers')
-rw-r--r-- | config/initializers/trusted_proxies.rb | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb index df4a933e22f..30770b71e24 100644 --- a/config/initializers/trusted_proxies.rb +++ b/config/initializers/trusted_proxies.rb @@ -11,6 +11,12 @@ module Rack end end +gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy| + begin + IPAddr.new(proxy) + rescue IPAddr::InvalidAddressError + end +end.compact + Rails.application.config.action_dispatch.trusted_proxies = ( - [ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies) -).map { |proxy| IPAddr.new(proxy) } + [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies) |