diff options
| author | Jeremy Kemper <jeremy@bitsweat.net> | 2008-03-28 21:38:01 +0000 |
|---|---|---|
| committer | Jeremy Kemper <jeremy@bitsweat.net> | 2008-03-28 21:38:01 +0000 |
| commit | a61b63d42056b119e061f7ebf31985887d569c79 (patch) | |
| tree | 326e6264702c422002d38235496ada5716137475 /actionpack/test/controller | |
| parent | 18049864cbe4bbdfd7eb0e96238877bfe74d79fd (diff) | |
| download | rails-a61b63d42056b119e061f7ebf31985887d569c79.tar.gz rails-a61b63d42056b119e061f7ebf31985887d569c79.tar.bz2 rails-a61b63d42056b119e061f7ebf31985887d569c79.zip | |
Avoid remote_ip spoofing
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@9124 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
Diffstat (limited to 'actionpack/test/controller')
| -rw-r--r-- | actionpack/test/controller/request_test.rb | 25 |
1 files changed, 23 insertions, 2 deletions
diff --git a/actionpack/test/controller/request_test.rb b/actionpack/test/controller/request_test.rb index 2f72f9017a..4d645f56e0 100644 --- a/actionpack/test/controller/request_test.rb +++ b/actionpack/test/controller/request_test.rb @@ -13,9 +13,17 @@ class RequestTest < Test::Unit::TestCase assert_equal '1.2.3.4', @request.remote_ip @request.env['HTTP_CLIENT_IP'] = '2.3.4.5' + assert_equal '1.2.3.4', @request.remote_ip + + @request.remote_addr = '192.168.0.1' assert_equal '2.3.4.5', @request.remote_ip @request.env.delete 'HTTP_CLIENT_IP' + @request.remote_addr = '1.2.3.4' + @request.env['HTTP_X_FORWARDED_FOR'] = '3.4.5.6' + assert_equal '1.2.3.4', @request.remote_ip + + @request.remote_addr = '127.0.0.1' @request.env['HTTP_X_FORWARDED_FOR'] = '3.4.5.6' assert_equal '3.4.5.6', @request.remote_ip @@ -35,10 +43,23 @@ class RequestTest < Test::Unit::TestCase assert_equal '3.4.5.6', @request.remote_ip @request.env['HTTP_X_FORWARDED_FOR'] = '127.0.0.1,3.4.5.6' - assert_equal '127.0.0.1', @request.remote_ip + assert_equal '3.4.5.6', @request.remote_ip @request.env['HTTP_X_FORWARDED_FOR'] = 'unknown,192.168.0.1' - assert_equal '1.2.3.4', @request.remote_ip + assert_equal 'unknown', @request.remote_ip + + @request.env['HTTP_X_FORWARDED_FOR'] = '9.9.9.9, 3.4.5.6, 10.0.0.1, 172.31.4.4' + assert_equal '3.4.5.6', @request.remote_ip + + @request.env['HTTP_CLIENT_IP'] = '8.8.8.8' + e = assert_raises(ActionController::ActionControllerError) { + @request.remote_ip + } + assert_match /IP spoofing attack/, e.message + assert_match /HTTP_X_FORWARDED_FOR="9.9.9.9, 3.4.5.6, 10.0.0.1, 172.31.4.4"/, e.message + assert_match /HTTP_CLIENT_IP="8.8.8.8"/, e.message + + @request.env.delete 'HTTP_CLIENT_IP' @request.env.delete 'HTTP_X_FORWARDED_FOR' end |