Repository: pallets/werkzeug

Issue:
ProxyFix may trust wrong number of values for X-Forwarded-Prefix
Due to a typo, `werkzeug.contrib.fixers.ProxyFix` gets the number of values to trust for `X-Forwarded-Prefix` from `x_for`, rather than from `x_prefix`.

```diff
diff --git a/werkzeug/contrib/fixers.py b/werkzeug/contrib/fixers.py
index 9a304405..af229cef 100644
--- a/werkzeug/contrib/fixers.py
+++ b/werkzeug/contrib/fixers.py
@@ -269,7 +269,7 @@ class ProxyFix(object):
             environ['SERVER_PORT'] = x_port
 
         x_prefix = self._get_trusted_comma(
-            self.x_for, environ_get('HTTP_X_FORWARDED_PREFIX'))
+            self.x_prefix, environ_get('HTTP_X_FORWARDED_PREFIX'))
         if x_prefix:
             environ['SCRIPT_NAME'] = x_prefix
 ```
ProxyFix may trust wrong number of values for X-Forwarded-Prefix
Due to a typo, `werkzeug.contrib.fixers.ProxyFix` gets the number of values to trust for `X-Forwarded-Prefix` from `x_for`, rather than from `x_prefix`.

```diff
diff --git a/werkzeug/contrib/fixers.py b/werkzeug/contrib/fixers.py
index 9a304405..af229cef 100644
--- a/werkzeug/contrib/fixers.py
+++ b/werkzeug/contrib/fixers.py
@@ -269,7 +269,7 @@ class ProxyFix(object):
             environ['SERVER_PORT'] = x_port
 
         x_prefix = self._get_trusted_comma(
-            self.x_for, environ_get('HTTP_X_FORWARDED_PREFIX'))
+            self.x_prefix, environ_get('HTTP_X_FORWARDED_PREFIX'))
         if x_prefix:
             environ['SCRIPT_NAME'] = x_prefix
 ```


Discussion:
Sounds like a very good candidate for a PR!
Nice catch, that was my typo. I'm currently working on another bug, so a PR would be helpful. :-)
Sounds like a very good candidate for a PR!
Nice catch, that was my typo. I'm currently working on another bug, so a PR would be helpful. :-)

Resolving patch:
diff --git a/werkzeug/contrib/fixers.py b/werkzeug/contrib/fixers.py
--- a/werkzeug/contrib/fixers.py
+++ b/werkzeug/contrib/fixers.py
@@ -269,7 +269,7 @@ def __call__(self, environ, start_response):
             environ['SERVER_PORT'] = x_port
 
         x_prefix = self._get_trusted_comma(
-            self.x_for, environ_get('HTTP_X_FORWARDED_PREFIX'))
+            self.x_prefix, environ_get('HTTP_X_FORWARDED_PREFIX'))
         if x_prefix:
             environ['SCRIPT_NAME'] = x_prefix
 


Test patch:
diff --git a/tests/contrib/test_fixers.py b/tests/contrib/test_fixers.py
--- a/tests/contrib/test_fixers.py
+++ b/tests/contrib/test_fixers.py
@@ -121,7 +121,13 @@ def test_path_info_from_request_uri_fix(self):
             'REMOTE_ADDR': '192.168.0.1',
             'HTTP_HOST': 'spam',
             'HTTP_X_FORWARDED_FOR': ', 192.168.0.3'
-        }, 'http://spam/', id='ignore empty')
+        }, 'http://spam/', id='ignore empty'),
+        pytest.param({'x_for': 2, 'x_prefix': 1}, {
+            'REMOTE_ADDR': '192.168.0.2',
+            'HTTP_HOST': 'spam',
+            'HTTP_X_FORWARDED_FOR': '192.168.0.1, 192.168.0.3',
+            'HTTP_X_FORWARDED_PREFIX': '/ham, /eggs',
+        }, 'http://spam/eggs/', id='prefix < for')
     ))
     def test_proxy_fix_new(self, kwargs, base, url_root):
         @Request.application