mirror of
https://github.com/linuxserver/Heimdall.git
synced 2026-08-07 07:16:13 +00:00
KodeStar
881533baa5
Heimdall trusted the incoming X-Forwarded-Host header for URL generation, so a spoofed value poisoned the page base href, asset() URLs and redirect targets - loading assets from and redirecting to an attacker-controlled host (CVE-2025-50578). - TrustProxies no longer trusts X-Forwarded-Host; a forged value can no longer influence getHost(), url(), asset() or redirects. X-Forwarded-For/Port/Proto handling is unchanged. - Trusted proxies are now configurable via the TRUSTED_PROXIES env var (comma-separated CIDRs/IPs, "*" to trust all), defaulting to the previous private ranges. - Added an opt-in TRUSTED_HOSTS allow-list: when set, only the listed hosts are served and any other Host header is rejected. Unset keeps the historic behaviour of serving arbitrary hosts, so existing installs are unaffected. Resolves #1451
60 lines
1.8 KiB
PHP
60 lines
1.8 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Illuminate\Http\Middleware\TrustProxies as Middleware;
|
|
use Illuminate\Http\Request;
|
|
|
|
class TrustProxies extends Middleware
|
|
{
|
|
/**
|
|
* The default trusted proxies used when the TRUSTED_PROXIES env var is unset.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $defaultProxies = ['192.168.0.0/16', '172.16.0.0/12', '10.0.0.0/8', '127.0.0.1'];
|
|
|
|
/**
|
|
* The trusted proxies for this application.
|
|
*
|
|
* @var array<int, string>|string|null
|
|
*/
|
|
protected $proxies;
|
|
|
|
/**
|
|
* The current proxy header mappings.
|
|
*
|
|
* Note: Request::HEADER_X_FORWARDED_HOST is intentionally NOT trusted to
|
|
* prevent Host header injection / open redirects (CVE-2025-50578). A spoofed
|
|
* X-Forwarded-Host header must never influence getHost()/url()/asset().
|
|
*
|
|
* @var int
|
|
*/
|
|
protected $headers = Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO | Request::HEADER_X_FORWARDED_AWS_ELB;
|
|
|
|
/**
|
|
* Create a new middleware instance.
|
|
*
|
|
* The set of trusted proxies is read from the TRUSTED_PROXIES env var
|
|
* (comma-separated CIDRs/IPs). When unset it falls back to the historic
|
|
* default list. The special value "*" trusts all proxies.
|
|
*
|
|
* @return void
|
|
*/
|
|
public function __construct()
|
|
{
|
|
$trustedProxies = env('TRUSTED_PROXIES');
|
|
|
|
if ($trustedProxies === null || trim((string) $trustedProxies) === '') {
|
|
$this->proxies = $this->defaultProxies;
|
|
} elseif (trim((string) $trustedProxies) === '*') {
|
|
$this->proxies = '*';
|
|
} else {
|
|
$this->proxies = array_values(array_filter(
|
|
array_map('trim', explode(',', (string) $trustedProxies)),
|
|
fn ($proxy) => $proxy !== ''
|
|
));
|
|
}
|
|
}
|
|
}
|