upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-09 00:32:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 35

Use Symfony IpUtils to check for local IP ranges

Browse source 
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
This commit is contained in:
Côme Chilliet 2022-07-12 12:09:05 +02:00 committed by backportbot-nextcloud[bot]
parent a04cb4dfa6
commit 91a244e77e
2 changed files with 11 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/private/Http/Client/LocalAddressChecker.php
View file

@ -37,12 +37,15 @@ class LocalAddressChecker {
}
public function ThrowIfLocalIp(string $ip) : void {
$localIps = ['100.100.100.200'];
$localRanges = [
'100.64.0.0/10', // See RFC 6598
'192.0.0.0/24', // See RFC 6890
];
if (
(bool)filter_var($ip, FILTER_VALIDATE_IP) &&
(
!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
in_array($ip, $localIps, true)
IpUtils::checkIp($ip, $localRanges)
)) {
$this->logger->warning("Host $ip was not connected to because it violates local access rules");
throw new LocalServerException('Host violates local access rules');
@ -55,7 +58,7 @@ class LocalAddressChecker {
if (
!filter_var($ipv4Address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) ||
in_array($ipv4Address, $localIps, true)) {
IpUtils::checkIp($ip, $localRanges)) {
$this->logger->warning("Host $ip was not connected to because it violates local access rules");
throw new LocalServerException('Host violates local access rules');
}

5
tests/lib/Http/Client/LocalAddressCheckerTest.php
View file

@ -96,6 +96,8 @@ class LocalAddressCheckerTest extends \Test\TestCase {
['10.0.0.1'],
['::'],
['::1'],
['100.100.100.200'],
['192.0.0.1'],
];
}
@ -116,6 +118,9 @@ class LocalAddressCheckerTest extends \Test\TestCase {
['another-host.local'],
['service.localhost'],
['!@#$'], // test invalid url
['100.100.100.200'],
['192.0.0.1'],
['randomdomain.internal'],
];
}