Updates to vendors etc

vendor/symfony/http-foundation/IpUtils.php

@@ -102,7 +102,7 @@ class IpUtils
             return self::setCacheResult($cacheKey, false);
         }
 
-        return self::setCacheResult($cacheKey, 0 === substr_compare(sprintf('%032b', ip2long($requestIp)), sprintf('%032b', ip2long($address)), 0, $netmask));
+        return self::setCacheResult($cacheKey, 0 === substr_compare(\sprintf('%032b', ip2long($requestIp)), \sprintf('%032b', ip2long($address)), 0, $netmask));
     }
 
     /**
@@ -178,25 +178,57 @@ class IpUtils
     /**
      * Anonymizes an IP/IPv6.
      *
-     * Removes the last byte for v4 and the last 8 bytes for v6 IPs
+     * Removes the last bytes of IPv4 and IPv6 addresses (1 byte for IPv4 and 8 bytes for IPv6 by default).
+     *
+     * @param int<0, 4>  $v4Bytes
+     * @param int<0, 16> $v6Bytes
      */
-    public static function anonymize(string $ip): string
+    public static function anonymize(string $ip/* , int $v4Bytes = 1, int $v6Bytes = 8 */): string
     {
+        $v4Bytes = 1 < \func_num_args() ? func_get_arg(1) : 1;
+        $v6Bytes = 2 < \func_num_args() ? func_get_arg(2) : 8;
+
+        if ($v4Bytes < 0 || $v6Bytes < 0) {
+            throw new \InvalidArgumentException('Cannot anonymize less than 0 bytes.');
+        }
+
+        if ($v4Bytes > 4 || $v6Bytes > 16) {
+            throw new \InvalidArgumentException('Cannot anonymize more than 4 bytes for IPv4 and 16 bytes for IPv6.');
+        }
+
+        /**
+         * If the IP contains a % symbol, then it is a local-link address with scoping according to RFC 4007
+         * In that case, we only care about the part before the % symbol, as the following functions, can only work with
+         * the IP address itself. As the scope can leak information (containing interface name), we do not want to
+         * include it in our anonymized IP data.
+         */
+        if (str_contains($ip, '%')) {
+            $ip = substr($ip, 0, strpos($ip, '%'));
+        }
+
         $wrappedIPv6 = false;
         if (str_starts_with($ip, '[') && str_ends_with($ip, ']')) {
             $wrappedIPv6 = true;
             $ip = substr($ip, 1, -1);
         }
 
+        $mappedIpV4MaskGenerator = function (string $mask, int $bytesToAnonymize) {
+            $mask .= str_repeat('ff', 4 - $bytesToAnonymize);
+            $mask .= str_repeat('00', $bytesToAnonymize);
+
+            return '::'.implode(':', str_split($mask, 4));
+        };
+
         $packedAddress = inet_pton($ip);
         if (4 === \strlen($packedAddress)) {
-            $mask = '255.255.255.0';
+            $mask = rtrim(str_repeat('255.', 4 - $v4Bytes).str_repeat('0.', $v4Bytes), '.');
         } elseif ($ip === inet_ntop($packedAddress & inet_pton('::ffff:ffff:ffff'))) {
-            $mask = '::ffff:ffff:ff00';
+            $mask = $mappedIpV4MaskGenerator('ffff', $v4Bytes);
         } elseif ($ip === inet_ntop($packedAddress & inet_pton('::ffff:ffff'))) {
-            $mask = '::ffff:ff00';
+            $mask = $mappedIpV4MaskGenerator('', $v4Bytes);
         } else {
-            $mask = 'ffff:ffff:ffff:ffff:0000:0000:0000:0000';
+            $mask = str_repeat('ff', 16 - $v6Bytes).str_repeat('00', $v6Bytes);
+            $mask = implode(':', str_split($mask, 4));
         }
         $ip = inet_ntop($packedAddress & inet_pton($mask));