TrustedProxyMiddleware::isTrustedProxy() - Code Metrics - Inspection of "API Stronger Injector service unregistration" - sminnee/silverstripe-framework - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — director-middleware ( 92e508...4c9b4c )

by Damian

created 2017-06-26 02:22 UTC

TrustedProxyMiddleware::isTrustedProxy() B

↳ Parent: TrustedProxyMiddleware

Complexity

Conditions	5
Paths	4

Size

Total Lines	22
Code Lines	10

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	5
eloc	10
nc	4
nop	1
dl	0
loc	22
rs	8.6737
c	0
b	0
f	0

<?php

namespace SilverStripe\Control\Middleware;

use SilverStripe\Control\HTTPRequest;
use SilverStripe\Control\Util\IPUtils;

/**
 * This middleware will rewrite headers that provide IP and host details from an upstream proxy.
 */
class TrustedProxyMiddleware implements HTTPMiddleware
{
    /**
     * Comma-separated list of IP ranges that are trusted to provide proxy headers.
     * Can also be 'none' or '*' (all)
     *
     * @var string
     */
    private $trustedProxyIPs = null;

    /**
     * Array of headers from which to lookup the hostname
     *
     * @var array
     */
    private $proxyHostHeaders = [
        'X-Forwarded-Host'
    ];

    /**
     * Array of headers from which to lookup the client IP
     *
     * @var array
     */
    private $proxyIPHeaders = [
        'Client-IP',
        'X-Forwarded-For'
    ];

    /**
     * Array of headers from which to lookup the client scheme (http/https)
     *
     * @var array
     */
    private $proxySchemeHeaders = [
        'X-Forwarded-Protocol',
        'X-Forwarded-Proto',
    ];

    /**
     * Return the comma-separated list of IP ranges that are trusted to provide proxy headers
     * Can also be 'none' or '*' (all)
     *
     * @return string
     */
    public function getTrustedProxyIPs()
    {
        return $this->trustedProxyIPs;
    }

    /**
     * Set the comma-separated list of IP ranges that are trusted to provide proxy headers
     * Can also be 'none' or '*' (all)
     *
     * @param string $trustedProxyIPs
     * @return $this
     */
    public function setTrustedProxyIPs($trustedProxyIPs)
    {
        $this->trustedProxyIPs = $trustedProxyIPs;
        return $this;
    }

    /**
     * Return the array of headers from which to lookup the hostname
     *
     * @return array
     */
    public function getProxyHostHeaders()
    {
        return $this->proxyHostHeaders;
    }

    /**
     * Set the array of headers from which to lookup the hostname
     * Can also specify comma-separated list as a single string.
     *
     * @param array|string $proxyHostHeaders
     * @return $this
     */
    public function setProxyHostHeaders($proxyHostHeaders)
    {
        if (is_string($proxyHostHeaders)) {
            $proxyHostHeaders = preg_split('/ *, */', $proxyHostHeaders);
        }
        $this->proxyHostHeaders = $proxyHostHeaders ?: [];
        return $this;
    }

    /**
     * Return the array of headers from which to lookup the client IP
     *
     * @return array
     */
    public function getProxyIPHeaders()
    {
        return $this->proxyIPHeaders;
    }

    /**
     * Set the array of headers from which to lookup the client IP
     * Can also specify comma-separated list as a single string.
     *
     * @param array|string $proxyIPHeaders
     * @return $this
     */
    public function setProxyIPHeaders($proxyIPHeaders)
    {
        if (is_string($proxyIPHeaders)) {
            $proxyIPHeaders = preg_split('/ *, */', $proxyIPHeaders);
        }
        $this->proxyIPHeaders = $proxyIPHeaders ?: [];
        return $this;
    }

    /**
     * Return the array of headers from which to lookup the client scheme (http/https)
     *
     * @return array
     */
    public function getProxySchemeHeaders()
    {
        return $this->proxySchemeHeaders;
    }

    /**
     * Set array of headers from which to lookup the client scheme (http/https)
     * Can also specify comma-separated list as a single string.
     *
     * @param array|string $proxySchemeHeaders
     * @return $this
     */
    public function setProxySchemeHeaders($proxySchemeHeaders)
    {
        if (is_string($proxySchemeHeaders)) {
            $proxySchemeHeaders = preg_split('/ *, */', $proxySchemeHeaders);
        }
        $this->proxySchemeHeaders = $proxySchemeHeaders ?: [];
        return $this;
    }

    public function process(HTTPRequest $request, callable $delegate)
    {
        // If this is a trust proxy
        if ($this->isTrustedProxy($request)) {
            // Replace host
            foreach ($this->getProxyHostHeaders() as $header) {
                $hostList = $request->getHeader($header);
                if ($hostList) {
                    $request->addHeader('Host', strtok($hostList, ','));
                    break;
                }
            }

            // Replace scheme
            foreach ($this->getProxySchemeHeaders() as $header) {
                $headerValue = $request->getHeader($header);
                if ($headerValue) {
                    $request->setScheme(strtolower($headerValue));
                    break;
                }
            }

            // Replace IP
            foreach ($this->proxyIPHeaders as $header) {
                $headerValue = $request->getHeader($header);
                if ($headerValue) {
                    $ipHeader = $this->getIPFromHeaderValue($headerValue);
                    if ($ipHeader) {
                        $request->setIP($ipHeader);
                        break;
                    }
                }
            }
        }

        return $delegate($request);
    }

    /**
     * Determine if the current request is coming from a trusted proxy
     *
     * @param HTTPRequest $request
     * @return bool True if the request's source IP is a trusted proxy
     */
    protected function isTrustedProxy(HTTPRequest $request)
    {
        $trustedIPs = $this->getTrustedProxyIPs();

        // Disabled
        if (empty($trustedIPs) || $trustedIPs === 'none') {
            return false;
        }

        // Allow all
        if ($trustedIPs === '*') {
            return true;
        }

        // Validate IP address
        $ip = $request->getIP();
        if ($ip) {
            return IPUtils::checkIP($ip, preg_split('/ *, */', $trustedIPs));
        }

        return false;
    }

    /**
     * Extract an IP address from a header value that has been obtained.
     * Accepts single IP or comma separated string of IPs
     *
     * @param string $headerValue The value from a trusted header
     * @return string The IP address
     */
    protected function getIPFromHeaderValue($headerValue)
    {
        // Sometimes the IP from a load balancer could be "x.x.x.x, y.y.y.y, z.z.z.z"
        // so we need to find the most likely candidate
        $ips = preg_split('/\s*,\s*/', $headerValue);

        // Prioritise filters
        $filters = [
            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE,
            FILTER_FLAG_NO_PRIV_RANGE,
            null
        ];
        foreach ($filters as $filter) {
            // Find best IP
            foreach ($ips as $ip) {
                if (filter_var($ip, FILTER_VALIDATE_IP, $filter)) {
                    return $ip;
                }
            }
        }
        return null;
    }
}


1			<?php
2
3			namespace SilverStripe\Control\Middleware;
4
5			use SilverStripe\Control\HTTPRequest;
6			use SilverStripe\Control\Util\IPUtils;
7
8			/**
9			* This middleware will rewrite headers that provide IP and host details from an upstream proxy.
10			*/
11			class TrustedProxyMiddleware implements HTTPMiddleware
12			{
13			/**
14			* Comma-separated list of IP ranges that are trusted to provide proxy headers.
15			* Can also be 'none' or '*' (all)
16			*
17			* @var string
18			*/
19			private $trustedProxyIPs = null;
20
21			/**
22			* Array of headers from which to lookup the hostname
23			*
24			* @var array
25			*/
26			private $proxyHostHeaders = [
27			'X-Forwarded-Host'
28			];
29
30			/**
31			* Array of headers from which to lookup the client IP
32			*
33			* @var array
34			*/
35			private $proxyIPHeaders = [
36			'Client-IP',
37			'X-Forwarded-For'
38			];
39
40			/**
41			* Array of headers from which to lookup the client scheme (http/https)
42			*
43			* @var array
44			*/
45			private $proxySchemeHeaders = [
46			'X-Forwarded-Protocol',
47			'X-Forwarded-Proto',
48			];
49
50			/**
51			* Return the comma-separated list of IP ranges that are trusted to provide proxy headers
52			* Can also be 'none' or '*' (all)
53			*
54			* @return string
55			*/
56			public function getTrustedProxyIPs()
57			{
58			return $this->trustedProxyIPs;
59			}
60
61			/**
62			* Set the comma-separated list of IP ranges that are trusted to provide proxy headers
63			* Can also be 'none' or '*' (all)
64			*
65			* @param string $trustedProxyIPs
66			* @return $this
67			*/
68			public function setTrustedProxyIPs($trustedProxyIPs)
69			{
70			$this->trustedProxyIPs = $trustedProxyIPs;
71			return $this;
72			}
73
74			/**
75			* Return the array of headers from which to lookup the hostname
76			*
77			* @return array
78			*/
79			public function getProxyHostHeaders()
80			{
81			return $this->proxyHostHeaders;
82			}
83
84			/**
85			* Set the array of headers from which to lookup the hostname
86			* Can also specify comma-separated list as a single string.
87			*
88			* @param array\|string $proxyHostHeaders
89			* @return $this
90			*/
91			public function setProxyHostHeaders($proxyHostHeaders)
92			{
93			if (is_string($proxyHostHeaders)) {
94			$proxyHostHeaders = preg_split('/ , /', $proxyHostHeaders);
95			}
96			$this->proxyHostHeaders = $proxyHostHeaders ?: [];
97			return $this;
98			}
99
100			/**
101			* Return the array of headers from which to lookup the client IP
102			*
103			* @return array
104			*/
105			public function getProxyIPHeaders()
106			{
107			return $this->proxyIPHeaders;
108			}
109
110			/**
111			* Set the array of headers from which to lookup the client IP
112			* Can also specify comma-separated list as a single string.
113			*
114			* @param array\|string $proxyIPHeaders
115			* @return $this
116			*/
117			public function setProxyIPHeaders($proxyIPHeaders)
118			{
119			if (is_string($proxyIPHeaders)) {
120			$proxyIPHeaders = preg_split('/ , /', $proxyIPHeaders);
121			}
122			$this->proxyIPHeaders = $proxyIPHeaders ?: [];
123			return $this;
124			}
125
126			/**
127			* Return the array of headers from which to lookup the client scheme (http/https)
128			*
129			* @return array
130			*/
131			public function getProxySchemeHeaders()
132			{
133			return $this->proxySchemeHeaders;
134			}
135
136			/**
137			* Set array of headers from which to lookup the client scheme (http/https)
138			* Can also specify comma-separated list as a single string.
139			*
140			* @param array\|string $proxySchemeHeaders
141			* @return $this
142			*/
143			public function setProxySchemeHeaders($proxySchemeHeaders)
144			{
145			if (is_string($proxySchemeHeaders)) {
146			$proxySchemeHeaders = preg_split('/ , /', $proxySchemeHeaders);
147			}
148			$this->proxySchemeHeaders = $proxySchemeHeaders ?: [];
149			return $this;
150			}
151
152			public function process(HTTPRequest $request, callable $delegate)
153			{
154			// If this is a trust proxy
155			if ($this->isTrustedProxy($request)) {
156			// Replace host
157			foreach ($this->getProxyHostHeaders() as $header) {
158			$hostList = $request->getHeader($header);
159			if ($hostList) {
160			$request->addHeader('Host', strtok($hostList, ','));
161			break;
162			}
163			}
164
165			// Replace scheme
166			foreach ($this->getProxySchemeHeaders() as $header) {
167			$headerValue = $request->getHeader($header);
168			if ($headerValue) {
169			$request->setScheme(strtolower($headerValue));
170			break;
171			}
172			}
173
174			// Replace IP
175			foreach ($this->proxyIPHeaders as $header) {
176			$headerValue = $request->getHeader($header);
177			if ($headerValue) {
178			$ipHeader = $this->getIPFromHeaderValue($headerValue);
179			if ($ipHeader) {
180			$request->setIP($ipHeader);
181			break;
182			}
183			}
184			}
185			}
186
187			return $delegate($request);
188			}
189
190			/**
191			* Determine if the current request is coming from a trusted proxy
192			*
193			* @param HTTPRequest $request
194			* @return bool True if the request's source IP is a trusted proxy
195			*/
196			protected function isTrustedProxy(HTTPRequest $request)
197			{
198			$trustedIPs = $this->getTrustedProxyIPs();
199
200			// Disabled
201			if (empty($trustedIPs) \|\| $trustedIPs === 'none') {
202			return false;
203			}
204
205			// Allow all
206			if ($trustedIPs === '*') {
207			return true;
208			}
209
210			// Validate IP address
211			$ip = $request->getIP();
212			if ($ip) {
213			return IPUtils::checkIP($ip, preg_split('/ , /', $trustedIPs));
214			}
215
216			return false;
217			}
218
219			/**
220			* Extract an IP address from a header value that has been obtained.
221			* Accepts single IP or comma separated string of IPs
222			*
223			* @param string $headerValue The value from a trusted header
224			* @return string The IP address
225			*/
226			protected function getIPFromHeaderValue($headerValue)
227			{
228			// Sometimes the IP from a load balancer could be "x.x.x.x, y.y.y.y, z.z.z.z"
229			// so we need to find the most likely candidate
230			$ips = preg_split('/\s,\s/', $headerValue);
231
232			// Prioritise filters
233			$filters = [
234			FILTER_FLAG_NO_PRIV_RANGE \| FILTER_FLAG_NO_RES_RANGE,
235			FILTER_FLAG_NO_PRIV_RANGE,
236			null
237			];
238			foreach ($filters as $filter) {
239			// Find best IP
240			foreach ($ips as $ip) {
241			if (filter_var($ip, FILTER_VALIDATE_IP, $filter)) {
242			return $ip;
243			}
244			}
245			}
246			return null;
247			}
248			}
249

sminnee / silverstripe-framework

Push — director-middleware ( 92e508...4c9b4c )

TrustedProxyMiddleware::isTrustedProxy() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like