Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #31576 from aooohan

Browse Source 
* pr/31576:
  Polish "Add configuration property for RemoteIpValve's trusted proxies"
  Add configuration property for RemoteIpValve's trusted proxies

Closes gh-31576
This commit is contained in:
Stephane Nicoll
2022-07-18 12:07:57 +02:00
parent 69050a96d2 f5f3d7cc67
commit 993e1bf5f2
4 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
View File

@@ -993,6 +993,12 @@ public class ServerProperties {
*/
private String remoteIpHeader;
/**
* Regular expression defining proxies that are trusted when they appear in
* the "remote-ip-header" header.
*/
private String trustedProxies;
public String getInternalProxies() {
return this.internalProxies;
}
@@ -1041,6 +1047,14 @@ public class ServerProperties {
this.remoteIpHeader = remoteIpHeader;
}
public String getTrustedProxies() {
return this.trustedProxies;
}
public void setTrustedProxies(String trustedProxies) {
this.trustedProxies = trustedProxies;
}
}
}

1
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java
View File

@@ -227,6 +227,7 @@ public class TomcatWebServerFactoryCustomizer
if (StringUtils.hasLength(remoteIpHeader)) {
valve.setRemoteIpHeader(remoteIpHeader);
}
valve.setTrustedProxies(remoteIpProperties.getTrustedProxies());
// The internal proxies default to a list of "safe" internal IP addresses
valve.setInternalProxies(remoteIpProperties.getInternalProxies());
try {

2
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java
View File

@@ -129,6 +129,7 @@ class ServerPropertiesTests {
map.put("server.tomcat.remoteip.protocol-header", "X-Forwarded-Protocol");
map.put("server.tomcat.remoteip.remote-ip-header", "Remote-Ip");
map.put("server.tomcat.remoteip.internal-proxies", "10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}");
map.put("server.tomcat.remoteip.trusted-proxies", "proxy1|proxy2|proxy3");
map.put("server.tomcat.reject-illegal-header", "false");
map.put("server.tomcat.background-processor-delay", "10");
map.put("server.tomcat.relaxed-path-chars", "|,<");
@@ -152,6 +153,7 @@ class ServerPropertiesTests {
assertThat(tomcat.getRemoteip().getRemoteIpHeader()).isEqualTo("Remote-Ip");
assertThat(tomcat.getRemoteip().getProtocolHeader()).isEqualTo("X-Forwarded-Protocol");
assertThat(tomcat.getRemoteip().getInternalProxies()).isEqualTo("10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}");
assertThat(tomcat.getRemoteip().getTrustedProxies()).isEqualTo("proxy1|proxy2|proxy3");
assertThat(tomcat.isRejectIllegalHeader()).isFalse();
assertThat(tomcat.getBackgroundProcessorDelay()).hasSeconds(10);
assertThat(tomcat.getRelaxedPathChars()).containsExactly('|', '<');

4
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java
View File

@@ -226,7 +226,8 @@ class TomcatWebServerFactoryCustomizerTests {
"server.tomcat.remoteip.internal-proxies=192.168.0.1",
"server.tomcat.remoteip.host-header=x-my-forward-host",
"server.tomcat.remoteip.port-header=x-my-forward-port",
"server.tomcat.remoteip.protocol-header-https-value=On");
"server.tomcat.remoteip.protocol-header-https-value=On",
"server.tomcat.remoteip.trusted-proxies=proxy1|proxy2");
TomcatServletWebServerFactory factory = customizeAndGetFactory();
assertThat(factory.getEngineValves()).hasSize(1);
Valve valve = factory.getEngineValves().iterator().next();
@@ -238,6 +239,7 @@ class TomcatWebServerFactoryCustomizerTests {
assertThat(remoteIpValve.getHostHeader()).isEqualTo("x-my-forward-host");
assertThat(remoteIpValve.getPortHeader()).isEqualTo("x-my-forward-port");
assertThat(remoteIpValve.getInternalProxies()).isEqualTo("192.168.0.1");
assertThat(remoteIpValve.getTrustedProxies()).isEqualTo("proxy1|proxy2");
}
@Test