Fixes yiisoft#16006: Handle case when X-Forwarded-Host header have …

…multiple hosts separated with a comma
Deele · Mar 31, 2018 · 35ac718 · 35ac718
1 parent bd837bc
commit 35ac718
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 1 deletion.
diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
@@ -4,6 +4,7 @@ Yii Framework 2 Change Log
 2.0.16 under development
 ------------------------
 
+- Bug #16006: Handle case when `X-Forwarded-Host` header have multiple hosts separated with a comma (pgaultier)
 - Bug #16010: Fixed `yii\filters\ContentNegotiator` behavior when GET parameters contain an array (rugabarbo)
 - Bug #14660: Fixed `yii\caching\DbCache` concurrency issue when set values with the same key (rugabarbo)
 - Bug #15988: Fixed bash completion (alekciy)

diff --git a/framework/web/Request.php b/framework/web/Request.php
@@ -710,7 +710,7 @@ public function getHostInfo()
             $http = $secure ? 'https' : 'http';
 
             if ($this->headers->has('X-Forwarded-Host')) {
-                $this->_hostInfo = $http . '://' . $this->headers->get('X-Forwarded-Host');
+                $this->_hostInfo = $http . '://' . trim(explode(',', $this->headers->get('X-Forwarded-Host'))[0]);
             } elseif ($this->headers->has('Host')) {
                 $this->_hostInfo = $http . '://' . $this->headers->get('Host');
             } elseif (isset($_SERVER['SERVER_NAME'])) {

diff --git a/tests/framework/web/RequestTest.php b/tests/framework/web/RequestTest.php
@@ -320,6 +320,19 @@ public function getHostInfoDataProvider()
                     'example3.com',
                 ]
             ],
+            // forwarded from trusted proxy
+            [
+                [
+                    'HTTP_X_FORWARDED_HOST' => 'example3.com, example2.com',
+                    'HTTP_HOST' => 'example1.com',
+                    'SERVER_NAME' => 'example2.com',
+                    'REMOTE_ADDR' => '192.168.0.1',
+                ],
+                [
+                    'http://example3.com',
+                    'example3.com',
+                ]
+            ],
         ];
     }