Update Request::getIp method

Author: natanfelles

src/Request.php

@@ -892,18 +892,26 @@ public function getId() : ?string
     /**
      * Get the connection IP.
      *
+     * @param bool $validate True to validate the IP address, otherwise false
+     *
+     * @throws RuntimeException for invalid IP address
+     *
      * @return string
      */
-    public function getIp() : string
+    public function getIp(bool $validate = true) : string
     {
         $key = $this->getIpKey();
-        if ($key === 'HTTP_FORWARDED') {
-            return $this->getIpFromHttpForwarded();
-        }
-        if ($key === 'HTTP_X_FORWARDED_FOR') {
-            return $this->getIpFromHttpXForwardedFor();
+        $ip = match($key) {
+            'HTTP_FORWARDED' => $this->getIpFromHttpForwarded(),
+            'HTTP_X_FORWARDED_FOR' => $this->getIpFromHttpXForwardedFor(),
+            default => $_SERVER[$key]
+        };
+        if ($validate && !\filter_var($ip, \FILTER_VALIDATE_IP)) {
+            throw new RuntimeException(
+                "The value of {$key} is not a valid IP address"
+            );
         }
-        return $_SERVER[$key];
+        return $ip;
     }
 
     /**

tests/RequestTest.php

@@ -719,13 +719,26 @@ public function testIpKeyWithHttpForwarded() : void
         $_SERVER['HTTP_FORWARDED'] = 'for="[2001:db8:cafe::17]", for=192.0.2.43';
         self::assertSame('2001:db8:cafe::17', $this->request->getIp());
         $_SERVER['HTTP_FORWARDED'] = 'for="foo", for=192.0.2.43';
-        self::assertSame('foo', $this->request->getIp());
+        self::assertSame('foo', $this->request->getIp(false));
         $_SERVER['HTTP_FORWARDED'] = 'foo';
         $this->expectException(RuntimeException::class);
         $this->expectExceptionMessage('The IP address could not be get from the Forwarded header');
         $this->request->getIp();
     }
 
+    /**
+     * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Forwarded#using_the_forwarded_header
+     */
+    public function testIpKeyWithHttpForwardedWithObfuscatedIdentifier() : void
+    {
+        $_SERVER['HTTP_FORWARDED'] = 'for="foo", for=192.0.2.43';
+        $this->request->setIpKey('HTTP_FORWARDED');
+        self::assertSame('foo', $this->request->getIp(false));
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('The value of HTTP_FORWARDED is not a valid IP address');
+        $this->request->getIp();
+    }
+
     public function testIpKeyException() : void
     {
         $this->expectException(\InvalidArgumentException::class);