Fix Sentry::Utils::RealIP not filtering trusted proxies when part of IP subnet passed as IPAddr to trusted_proxies.#1498
Merged
st0012 merged 1 commit intogetsentry:masterfrom Jul 8, 2021
vojtad:fix-real-ip
Merged
Fix Sentry::Utils::RealIP not filtering trusted proxies when part of IP subnet passed as IPAddr to trusted_proxies.#1498st0012 merged 1 commit intogetsentry:masterfrom vojtad:fix-real-ip
Sentry::Utils::RealIP not filtering trusted proxies when part of IP subnet passed as IPAddr to trusted_proxies.#1498st0012 merged 1 commit intogetsentry:masterfrom
vojtad:fix-real-ip
Conversation
…f IP subnet passed as `IPAddr` to `trusted_proxies`. Also fixes `Sentry::Utils::RealIP` with proxies loaded from Rails' `config.action_dispatch.trusted_proxies` because they are stored as instances of `IPAddr`.
Codecov Report
@@ Coverage Diff @@
## master #1498 +/- ##
==========================================
+ Coverage 98.21% 98.78% +0.56%
==========================================
Files 218 123 -95
Lines 10553 6723 -3830
==========================================
- Hits 10365 6641 -3724
+ Misses 188 82 -106 Continue to review full report at Codecov.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Filtering trusted proxies based on list of IP subnets passed as instances of
IPAddrgot broken in #1288.When calling
IPAddr#to_sresulting string doesn't contain the IP mask. Therefore when creatingIPAddragain from this string IP mask is lost and filtering trusted proxies is broken.I changed
Sentry::Utils::RealIPto only call.to_swhen trusted proxy entry is not an instance ofIPAddr. This keeps complete information about defined IP subnet as trusted proxy and makes filtering work as expected.I've also added a test for this case.
This PR also fixes
Sentry::Utils::RealIPwith proxies loaded from Rails'config.action_dispatch.trusted_proxiesbecause they are stored as instances ofIPAddr.