diff options
| author | Stan Hu <stanhu@gmail.com> | 2016-07-23 21:01:23 -0700 |
|---|---|---|
| committer | Stan Hu <stanhu@gmail.com> | 2016-07-23 21:06:19 -0700 |
| commit | 8d73c7613178f5d46ff91a81f7783ca907deb64a (patch) | |
| tree | efdf5ed38e0d465b71127a09ed0e807f3b5b0cbb /config/initializers | |
| parent | 03738bdd48d64e30c068df54eaf7e44d21e3c9fa (diff) | |
| download | gitlab-ce-8d73c7613178f5d46ff91a81f7783ca907deb64a.tar.gz | |
Ignore invalid trusted proxies in X-Forwarded-For headerreject-invalid-trusted-proxies
Certain reverse proxies can send invalid IP addresses in the X-Forwarded-For header
For example, Apache can send (null).
Closes #20194
Diffstat (limited to 'config/initializers')
| -rw-r--r-- | config/initializers/trusted_proxies.rb | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb index df4a933e22f..30770b71e24 100644 --- a/config/initializers/trusted_proxies.rb +++ b/config/initializers/trusted_proxies.rb @@ -11,6 +11,12 @@ module Rack end end +gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy| + begin + IPAddr.new(proxy) + rescue IPAddr::InvalidAddressError + end +end.compact + Rails.application.config.action_dispatch.trusted_proxies = ( - [ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies) -).map { |proxy| IPAddr.new(proxy) } + [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies) |