Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/requests/util/util_test.go

@@ -6,6 +6,7 @@ import (
 	"net/http/httptest"
 
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests/util"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -19,8 +20,13 @@ var _ = Describe("Util Suite", func() {
 		uriNoQueryParams   = "/test/endpoint"
 	)
 	var req *http.Request
+	var trustedProxies *ip.NetSet
 
 	BeforeEach(func() {
+		var err error
+		trustedProxies, err = ip.ParseNetSet([]string{"127.0.0.1"})
+		Expect(err).ToNot(HaveOccurred())
+
 		req = httptest.NewRequest(
 			http.MethodGet,
 			fmt.Sprintf("%s://%s%s", proto, host, uriWithQueryParams),
@@ -29,7 +35,7 @@ var _ = Describe("Util Suite", func() {
 	})
 
 	Context("GetRequestHost", func() {
-		Context("IsProxied is false", func() {
+		Context("trusted forwarded headers are disabled", func() {
 			BeforeEach(func() {
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{})
 			})
@@ -44,10 +50,12 @@ var _ = Describe("Util Suite", func() {
 			})
 		})
 
-		Context("IsProxied is true", func() {
+		Context("trusted forwarded headers are enabled", func() {
 			BeforeEach(func() {
+				req.RemoteAddr = "127.0.0.1:4180"
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{
-					ReverseProxy: true,
+					ReverseProxy:   true,
+					TrustedProxies: trustedProxies,
 				})
 			})
 
@@ -63,7 +71,7 @@ var _ = Describe("Util Suite", func() {
 	})
 
 	Context("GetRequestProto", func() {
-		Context("IsProxied is false", func() {
+		Context("trusted forwarded headers are disabled", func() {
 			BeforeEach(func() {
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{})
 			})
@@ -78,10 +86,12 @@ var _ = Describe("Util Suite", func() {
 			})
 		})
 
-		Context("IsProxied is true", func() {
+		Context("trusted forwarded headers are enabled", func() {
 			BeforeEach(func() {
+				req.RemoteAddr = "127.0.0.1:4180"
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{
-					ReverseProxy: true,
+					ReverseProxy:   true,
+					TrustedProxies: trustedProxies,
 				})
 			})
 
@@ -97,7 +107,7 @@ var _ = Describe("Util Suite", func() {
 	})
 
 	Context("GetRequestURI", func() {
-		Context("IsProxied is false", func() {
+		Context("trusted forwarded headers are disabled", func() {
 			BeforeEach(func() {
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{})
 			})
@@ -112,10 +122,12 @@ var _ = Describe("Util Suite", func() {
 			})
 		})
 
-		Context("IsProxied is true", func() {
+		Context("trusted forwarded headers are enabled", func() {
 			BeforeEach(func() {
+				req.RemoteAddr = "127.0.0.1:4180"
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{
-					ReverseProxy: true,
+					ReverseProxy:   true,
+					TrustedProxies: trustedProxies,
 				})
 			})
 
@@ -131,7 +143,7 @@ var _ = Describe("Util Suite", func() {
 	})
 
 	Context("GetRequestPath", func() {
-		Context("IsProxied is false", func() {
+		Context("trusted forwarded headers are disabled", func() {
 			BeforeEach(func() {
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{})
 			})
@@ -146,10 +158,12 @@ var _ = Describe("Util Suite", func() {
 			})
 		})
 
-		Context("IsProxied is true", func() {
+		Context("trusted forwarded headers are enabled", func() {
 			BeforeEach(func() {
+				req.RemoteAddr = "127.0.0.1:4180"
 				req = middleware.AddRequestScope(req, &middleware.RequestScope{
-					ReverseProxy: true,
+					ReverseProxy:   true,
+					TrustedProxies: trustedProxies,
 				})
 			})
 
@@ -163,4 +177,30 @@ var _ = Describe("Util Suite", func() {
 			})
 		})
 	})
+
+	Context("CanTrustForwardedHeaders", func() {
+		It("returns false when no scope is present", func() {
+			Expect(util.CanTrustForwardedHeaders(req)).To(BeFalse())
+		})
+
+		It("returns true when the remote address is trusted", func() {
+			req.RemoteAddr = "127.0.0.1:4180"
+			req = middleware.AddRequestScope(req, &middleware.RequestScope{
+				ReverseProxy:   true,
+				TrustedProxies: trustedProxies,
+			})
+
+			Expect(util.CanTrustForwardedHeaders(req)).To(BeTrue())
+		})
+
+		It("returns false when the remote address is untrusted", func() {
+			req.RemoteAddr = "192.0.2.10:4180"
+			req = middleware.AddRequestScope(req, &middleware.RequestScope{
+				ReverseProxy:   true,
+				TrustedProxies: trustedProxies,
+			})
+
+			Expect(util.CanTrustForwardedHeaders(req)).To(BeFalse())
+		})
+	})
 })