Skip to content

Commit a652132

Browse files
fabpotfabpot
committed
feature #58161 [FrameworkBundle][HttpKernel] Add support for SYMFONY_TRUSTED_PROXIES, SYMFONY_TRUSTED_HEADERS, SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER and SYMFONY_TRUSTED_HOSTS env vars (nicolas-grekas)
This PR was merged into the 7.2 branch. Discussion ---------- [FrameworkBundle][HttpKernel] Add support for `SYMFONY_TRUSTED_PROXIES`, `SYMFONY_TRUSTED_HEADERS`, `SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER` and `SYMFONY_TRUSTED_HOSTS` env vars | Q | A | ------------- | --- | Branch? | 7.2 | Bug fix? | no | New feature? | yes | Deprecations? | no | Issues | - | License | MIT Adding support for `SYMFONY_TRUSTED_PROXIES`, `SYMFONY_TRUSTED_HEADERS`, `SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER` and `SYMFONY_TRUSTED_HOSTS` env vars. This PR proposes making the default configuration rely on these env var when the corresponding config options are not set. This should make it easier to package or deploy Symfony apps together with a pre-configured web-server or reverse-proxy. Commits ------- 60bd068d66 [FrameworkBundle][HttpKernel] Add support for `SYMFONY_TRUSTED_PROXIES`, `SYMFONY_TRUSTED_HEADERS`, `SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER` and `SYMFONY_TRUSTED_HOSTS` env vars
2 parents 7774843 + ffe8193 commit a652132

File tree

4 files changed

+15
-39
lines changed

4 files changed

+15
-39
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ CHANGELOG
1616
* Deprecate `session.sid_length` and `session.sid_bits_per_character` config options
1717
* Add the ability to use an existing service as a lock/semaphore resource
1818
* Add support for configuring multiple serializer instances via the configuration
19+
* Add support for `SYMFONY_TRUSTED_PROXIES`, `SYMFONY_TRUSTED_HEADERS`, `SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER` and `SYMFONY_TRUSTED_HOSTS` env vars
1920

2021
7.1
2122
---

‎DependencyInjection/Configuration.php

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ public function getConfigTreeBuilder(): TreeBuilder
9090
->end()
9191
->scalarNode('trust_x_sendfile_type_header')
9292
->info('Set true to enable support for xsendfile in binary file responses.')
93-
->defaultFalse()
93+
->defaultValue('%env(bool:default::SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER)%')
9494
->end()
9595
->scalarNode('ide')->defaultValue($this->debug ? '%env(default::SYMFONY_IDE)%' : null)->end()
9696
->booleanNode('test')->end()
@@ -108,26 +108,23 @@ public function getConfigTreeBuilder(): TreeBuilder
108108
->prototype('scalar')->end()
109109
->end()
110110
->arrayNode('trusted_hosts')
111-
->beforeNormalization()->ifString()->then(fn ($v) => [$v])->end()
111+
->beforeNormalization()->ifString()->then(static fn ($v) => $v ? [$v] : [])->end()
112112
->prototype('scalar')->end()
113+
->defaultValue(['%env(default::SYMFONY_TRUSTED_HOSTS)%'])
113114
->end()
114115
->variableNode('trusted_proxies')
115116
->beforeNormalization()
116117
->ifTrue(fn ($v) => 'private_ranges' === $v || 'PRIVATE_SUBNETS' === $v)
117118
->then(fn () => IpUtils::PRIVATE_SUBNETS)
118119
->end()
120+
->defaultValue(['%env(default::SYMFONY_TRUSTED_PROXIES)%'])
119121
->end()
120122
->arrayNode('trusted_headers')
121123
->fixXmlConfig('trusted_header')
122124
->performNoDeepMerging()
123-
->defaultValue(['x-forwarded-for', 'x-forwarded-port', 'x-forwarded-proto'])
124-
->beforeNormalization()->ifString()->then(fn ($v) => $v ? array_map('trim', explode(',', $v)) : [])->end()
125-
->enumPrototype()
126-
->values([
127-
'forwarded',
128-
'x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-prefix',
129-
])
130-
->end()
125+
->beforeNormalization()->ifString()->then(static fn ($v) => $v ? [$v] : [])->end()
126+
->prototype('scalar')->end()
127+
->defaultValue(['%env(default::SYMFONY_TRUSTED_HEADERS)%'])
131128
->end()
132129
->scalarNode('error_controller')
133130
->defaultValue('error_controller')

‎DependencyInjection/FrameworkExtension.php

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -313,14 +313,14 @@ public function load(array $configs, ContainerBuilder $container): void
313313

314314
$container->setParameter('kernel.http_method_override', $config['http_method_override']);
315315
$container->setParameter('kernel.trust_x_sendfile_type_header', $config['trust_x_sendfile_type_header']);
316-
$container->setParameter('kernel.trusted_hosts', $config['trusted_hosts']);
316+
$container->setParameter('kernel.trusted_hosts', [0] === array_keys($config['trusted_hosts']) ? $config['trusted_hosts'][0] : $config['trusted_hosts']);
317317
$container->setParameter('kernel.default_locale', $config['default_locale']);
318318
$container->setParameter('kernel.enabled_locales', $config['enabled_locales']);
319319
$container->setParameter('kernel.error_controller', $config['error_controller']);
320320

321321
if (($config['trusted_proxies'] ?? false) && ($config['trusted_headers'] ?? false)) {
322-
$container->setParameter('kernel.trusted_proxies', $config['trusted_proxies']);
323-
$container->setParameter('kernel.trusted_headers', $this->resolveTrustedHeaders($config['trusted_headers']));
322+
$container->setParameter('kernel.trusted_proxies', \is_array($config['trusted_proxies']) && [0] === array_keys($config['trusted_proxies']) ? $config['trusted_proxies'][0] : $config['trusted_proxies']);
323+
$container->setParameter('kernel.trusted_headers', [0] === array_keys($config['trusted_headers']) ? $config['trusted_headers'][0] : $config['trusted_headers']);
324324
}
325325

326326
if (!$container->hasParameter('debug.file_link_format')) {
@@ -3114,25 +3114,6 @@ private function registerHtmlSanitizerConfiguration(array $config, ContainerBuil
31143114
}
31153115
}
31163116

3117-
private function resolveTrustedHeaders(array $headers): int
3118-
{
3119-
$trustedHeaders = 0;
3120-
3121-
foreach ($headers as $h) {
3122-
$trustedHeaders |= match ($h) {
3123-
'forwarded' => Request::HEADER_FORWARDED,
3124-
'x-forwarded-for' => Request::HEADER_X_FORWARDED_FOR,
3125-
'x-forwarded-host' => Request::HEADER_X_FORWARDED_HOST,
3126-
'x-forwarded-proto' => Request::HEADER_X_FORWARDED_PROTO,
3127-
'x-forwarded-port' => Request::HEADER_X_FORWARDED_PORT,
3128-
'x-forwarded-prefix' => Request::HEADER_X_FORWARDED_PREFIX,
3129-
default => 0,
3130-
};
3131-
}
3132-
3133-
return $trustedHeaders;
3134-
}
3135-
31363117
public function getXsdValidationBasePath(): string|false
31373118
{
31383119
return \dirname(__DIR__).'/Resources/config/schema';

‎Tests/DependencyInjection/ConfigurationTest.php

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -704,19 +704,16 @@ protected static function getBundleDefaultConfig()
704704
return [
705705
'http_method_override' => false,
706706
'handle_all_throwables' => true,
707-
'trust_x_sendfile_type_header' => false,
707+
'trust_x_sendfile_type_header' => '%env(bool:default::SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER)%',
708708
'ide' => '%env(default::SYMFONY_IDE)%',
709709
'default_locale' => 'en',
710710
'enabled_locales' => [],
711711
'set_locale_from_accept_language' => false,
712712
'set_content_language_from_locale' => false,
713713
'secret' => 's3cr3t',
714-
'trusted_hosts' => [],
715-
'trusted_headers' => [
716-
'x-forwarded-for',
717-
'x-forwarded-port',
718-
'x-forwarded-proto',
719-
],
714+
'trusted_hosts' => ['%env(default::SYMFONY_TRUSTED_HOSTS)%'],
715+
'trusted_proxies' => ['%env(default::SYMFONY_TRUSTED_PROXIES)%'],
716+
'trusted_headers' => ['%env(default::SYMFONY_TRUSTED_HEADERS)%'],
720717
'csrf_protection' => [
721718
'enabled' => false,
722719
],

0 commit comments

Comments
 (0)