From 8d73c7613178f5d46ff91a81f7783ca907deb64a Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sat, 23 Jul 2016 21:01:23 -0700
Subject: Ignore invalid trusted proxies in X-Forwarded-For header
Certain reverse proxies can send invalid IP addresses in the X-Forwarded-For header
For example, Apache can send (null).
Closes #20194
---
config/initializers/trusted_proxies.rb | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
(limited to 'config')
diff --git a/config/initializers/trusted_proxies.rb b/config/initializers/trusted_proxies.rb
index df4a933e22f..30770b71e24 100644
--- a/config/initializers/trusted_proxies.rb
+++ b/config/initializers/trusted_proxies.rb
@@ -11,6 +11,12 @@ module Rack
end
end
+gitlab_trusted_proxies = Array(Gitlab.config.gitlab.trusted_proxies).map do |proxy|
+ begin
+ IPAddr.new(proxy)
+ rescue IPAddr::InvalidAddressError
+ end
+end.compact
+
Rails.application.config.action_dispatch.trusted_proxies = (
- [ '127.0.0.1', '::1' ] + Array(Gitlab.config.gitlab.trusted_proxies)
-).map { |proxy| IPAddr.new(proxy) }
+ [ '127.0.0.1', '::1' ] + gitlab_trusted_proxies)
--
cgit v1.2.1