From 53f4d7f0292a97770081a40a4c3562d414786739 Mon Sep 17 00:00:00 2001 From: Matt Jankowski Date: Wed, 11 Mar 2026 05:51:49 -0400 Subject: [PATCH] Update `RemoteIp` patch with Rails 8.1 changes (#38139) --- lib/action_dispatch/remote_ip_extensions.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/action_dispatch/remote_ip_extensions.rb b/lib/action_dispatch/remote_ip_extensions.rb index e5c48bf3c5..bf78c69439 100644 --- a/lib/action_dispatch/remote_ip_extensions.rb +++ b/lib/action_dispatch/remote_ip_extensions.rb @@ -17,11 +17,11 @@ module ActionDispatch module GetIpExtensions def calculate_ip # Set by the Rack web server, this is a single value. - remote_addr = ips_from(@req.remote_addr).last + remote_addr = sanitize_ips(ips_from(@req.remote_addr)).last # Could be a CSV list and/or repeated headers that were concatenated. - client_ips = ips_from(@req.client_ip).reverse! - forwarded_ips = ips_from(@req.x_forwarded_for).reverse! + client_ips = sanitize_ips(ips_from(@req.client_ip)).reverse! + forwarded_ips = sanitize_ips(@req.forwarded_for || []).reverse! # `Client-Ip` and `X-Forwarded-For` should not, generally, both be set. If they # are both set, it means that either: