cloudflare-rails 6.1.0 → 6.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '079b27f2bb751ae57b6ba12fa77c04abe62900241146ad7163b5c1f354a6a7a5'
-  data.tar.gz: 820820c94a3e782deae3ed94d67d9cc145c976b0a82fa313ee448e8f29708e3b
+  metadata.gz: 6744917646a84fbd4d06faabf47537911ebc59369ab4848c0a3e9979ee21116e
+  data.tar.gz: 7bf4fc1daee7eb7101056eb3ab18d765ccfccbe5b8c02608f65daced10d0f49b
 SHA512:
-  metadata.gz: a50b5891b48031f1a8a92ebfd08d63f4196df71abb14b5b4d24ab283f81170e3a68c6e04440d27a4c6ad7180030125bbbcff94ba708590536407b72b836acf82
-  data.tar.gz: 1bbfa4fd1c77980454d38c76cb9c9ec1da912ada1460d0554d4b1da534a41c3e8e1022876b9090c6161223ecfcf61ddd1ce9868cd6654dab7eeba3b34fd81c06
+  metadata.gz: 49816d30c9ef0c1b59aac36eb59d4a30465d285e0426ed7a1c3b41439910acb2ab4c0f71c2d7f4fa90a5c02baba2ad58b23338b446120c6c4b078d691cede797
+  data.tar.gz: 2121fa3a384f1d3630cb0f87bd2a40bb6228ad2a5defa8fddad514c6b84c9cca37e19bc50bbdbf69e4fdee43966ba7cd8e7fb53f109176e8a45e1df3d63e0cf9

data/CHANGELOG.md

@@ -3,6 +3,9 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [6.2.0]
+- Trust X-Forwarded-For from the right to the left (https://github.com/modosc/cloudflare-rails/pull/162)
+
 ## [6.1.0]
 - Add cloudflare? method to determine if request passed through CF (https://github.com/modosc/cloudflare-rails/pull/149)
 

data/README.md

@@ -1,4 +1,5 @@
 # CloudflareRails [![Gem Version](https://badge.fury.io/rb/cloudflare-rails.svg)](https://badge.fury.io/rb/cloudflare-rails)
+
 This gem correctly configures Rails for [CloudFlare](https://www.cloudflare.com) so that `request.remote_ip` / `request.ip` both work correctly. It also exposes a `#cloudflare?` method on `Rack::Request`.
 
 ## Rails Compatibility
@@ -38,9 +39,11 @@ Using Cloudflare means it's hard to identify the IP address of incoming requests
 `cloudflare-rails` mitigates this attack by checking that the originating ip address of any incoming connection is from one of Cloudflare's ip address ranges. If so, the incoming `X-Forwarded-For` header is trusted and used as the ip address provided to `rack` and `rails` (via `request.ip` and `request.remote_ip`). If the incoming connection does not originate from a Cloudflare server then the `X-Forwarded-For` header is ignored and the actual remote ip address is used.
 
 ## How it works
+
 This code fetches and caches CloudFlare's current [IPv4](https://www.cloudflare.com/ips-v4) and [IPv6](https://www.cloudflare.com/ips-v6) lists. It then patches `Rack::Request::Helpers` and `ActionDispatch::RemoteIP` to treat these addresses as trusted proxies. The `X-Forwarded-For` header will then be trusted only from those ip addresses.
 
 ### Why not use `config.action_dispatch.trusted_proxies` or `Rack::Request.ip_filter?`
+
 By default Rails includes the [ActionDispatch::RemoteIp](https://api.rubyonrails.org/classes/ActionDispatch/RemoteIp.html) middleware. This middleware uses a default list of [trusted proxies](https://github.com/rails/rails/blob/6b93fff8af32ef5e91f4ec3cfffb081d0553faf0/actionpack/lib/action_dispatch/middleware/remote_ip.rb#L36C5-L42). Any values from `config.action_dispatch.trusted_proxies` are appended to this list. If you were to set `config.action_dispatch.trusted_proxies` to the current list of Cloudflare IP addresses `request.remote_ip` would work correctly.
 
 Unfortunately this does not fix `request.ip`. This method comes from the [Rack::Request](https://github.com/rack/rack/blob/main/lib/rack/request.rb) middleware. It has a separate implementation of [trusted proxies](https://github.com/rack/rack/blob/main/lib/rack/request.rb#L48-L56) and [ip filtering](https://github.com/rack/rack/blob/main/lib/rack/request.rb#L58C1-L59C1). The only way to use a different implementation is to set `Rack::Request.ip_filter` which expects a callable value. Providing a new one will override the old one so you'd lose the default values (all of which should be there). Those values aren't exported anywhere so your callable would now have to maintain _that_ list on top of the Cloudflare IPs.
@@ -48,33 +51,36 @@ Unfortunately this does not fix `request.ip`. This method comes from the [Rack::
 These issues are why this gem patches both `Rack::Request::Helpers` and `ActionDispatch::RemoteIP` rather than using the built-in configuration methods.
 
 ## Prerequisites
+
 You must have a [`cache_store`](https://guides.rubyonrails.org/caching_with_rails.html#configuration) configured in your `rails` application.
 
 ## Usage
+
 You can configure the HTTP `timeout` and `expires_in` cache parameters inside of your `rails` config:
+
 ```ruby
 config.cloudflare.expires_in = 12.hours # default value
 config.cloudflare.timeout = 5.seconds # default value
 ```
 
 ## Blocking non-Cloudflare traffic
-You can use the `#cloudfront?` method from this gem to block all non-Cloudflare traffic to your application. Here's an example of doing this with [`Rack::Attack`](https://github.com/rack/rack-attack):
+
+You can use the `#cloudflare?` method from this gem to block all non-Cloudflare traffic to your application. Here's an example of doing this with [`Rack::Attack`](https://github.com/rack/rack-attack):
+
 ```ruby
   Rack::Attack.blocklist('CloudFlare WAF bypass') do |req|
     !req.cloudflare?
   end
 ```
-Note that the request may optionally pass through additional trusted proxies, so it will return true for any of these scenarios:
-
- * `REMOTE_ADDR: CloudFlare`
- * `REMOTE_ADDR: trusted_proxy`, `X_HTTP_FORWARDED_FOR: CloudFlare`
- * `REMOTE_ADDR: trusted_proxy`, `X_HTTP_FORWARDED_FOR: trusted_proxy2,CloudFlare,...`
 
-but it will return false if CloudFlare comes after the trusted prefix of `X-Forwarded-For`.
+Note that the request may optionally pass through additional trusted proxies, so it will return `true` for any of these scenarios:
 
-## Alternatives
+-   `REMOTE_ADDR: CloudFlare`
+-   `REMOTE_ADDR: trusted_proxy`, `X_HTTP_FORWARDED_FOR: CloudFlare`
+-   `REMOTE_ADDR: trusted_proxy`, `X_HTTP_FORWARDED_FOR: CloudFlare,trusted_proxy2`
+-   `REMOTE_ADDR: trusted_proxy`, `X_HTTP_FORWARDED_FOR: untrusted,CloudFlare`
 
-[actionpack-cloudflare](https://github.com/customink/actionpack-cloudflare) simpler approach using the `CF-Connecting-IP` header.
+but it will return `false` if CloudFlare comes to the left of an untrusted IP in `X-Forwarded-For`.
 
 ## Development
 

data/cloudflare-rails.gemspec

@@ -27,9 +27,8 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rubocop', '~> 1.66.1'
   spec.add_development_dependency 'rubocop-performance', '~> 1.22.1'
   spec.add_development_dependency 'rubocop-rails', '~> 2.26.1'
-  spec.add_development_dependency 'rubocop-rspec', '~> 3.0.1'
-  spec.add_development_dependency 'webmock', '~> 3.23.1'
-
+  spec.add_development_dependency 'rubocop-rspec', '~> 3.1.0'
+  spec.add_development_dependency 'webmock', '~> 3.24.0'
   spec.add_dependency 'actionpack', '>= 7.1.0', '< 8.1.0'
   spec.add_dependency 'activesupport', '>= 7.1.0', '< 8.1.0'
   spec.add_dependency 'railties', '>= 7.1.0', '< 8.1.0'

data/lib/cloudflare_rails/check_trusted_proxies.rb

@@ -20,7 +20,7 @@ module CloudflareRails
       forwarded_for = self.forwarded_for || []
 
       # Select only the trusted prefix of REMOTE_ADDR + X_HTTP_FORWARDED_FOR
-      trusted_proxies = (remote_addresses + forwarded_for).take_while do |ip|
+      trusted_proxies = (remote_addresses + forwarded_for.reverse).take_while do |ip|
         trusted_proxy?(ip)
       end
 

data/lib/cloudflare_rails/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CloudflareRails
-  VERSION = '6.1.0'
+  VERSION = '6.2.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cloudflare-rails
 version: !ruby/object:Gem::Version
-  version: 6.1.0
+  version: 6.2.0
 platform: ruby
 authors:
 - jonathan schatz
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-09-23 00:00:00.000000000 Z
+date: 2024-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: appraisal
@@ -156,28 +156,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.0.1
+        version: 3.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.0.1
+        version: 3.1.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.23.1
+        version: 3.24.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.23.1
+        version: 3.24.0
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement