diff --git a/test/webrick/test_httpresponse.rb b/test/webrick/test_httpresponse.rb index e8c69a1212..89a0f7036e 100644 --- a/test/webrick/test_httpresponse.rb +++ b/test/webrick/test_httpresponse.rb @@ -30,70 +30,70 @@ module WEBrick end def test_prevent_response_splitting_headers_crlf - res['X-header'] = "malicious\r\nCookie: hack" + res['X-header'] = "malicious\r\nCookie: cracked_indicator_for_test" io = StringIO.new res.send_response io io.rewind res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) assert_equal '500', res.code - refute_match 'hack', io.string + refute_match 'cracked_indicator_for_test', io.string end def test_prevent_response_splitting_cookie_headers_crlf - user_input = "malicious\r\nCookie: hack" + user_input = "malicious\r\nCookie: cracked_indicator_for_test" res.cookies << WEBrick::Cookie.new('author', user_input) io = StringIO.new res.send_response io io.rewind res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) assert_equal '500', res.code - refute_match 'hack', io.string + refute_match 'cracked_indicator_for_test', io.string end def test_prevent_response_splitting_headers_cr - res['X-header'] = "malicious\rCookie: hack" + res['X-header'] = "malicious\rCookie: cracked_indicator_for_test" io = StringIO.new res.send_response io io.rewind res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) assert_equal '500', res.code - refute_match 'hack', io.string + refute_match 'cracked_indicator_for_test', io.string end def test_prevent_response_splitting_cookie_headers_cr - user_input = "malicious\rCookie: hack" + user_input = "malicious\rCookie: cracked_indicator_for_test" res.cookies << WEBrick::Cookie.new('author', user_input) io = StringIO.new res.send_response io io.rewind res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) assert_equal '500', res.code - refute_match 'hack', io.string + refute_match 'cracked_indicator_for_test', io.string end def test_prevent_response_splitting_headers_lf - res['X-header'] = "malicious\nCookie: hack" + res['X-header'] = "malicious\nCookie: cracked_indicator_for_test" io = StringIO.new res.send_response io io.rewind res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) assert_equal '500', res.code - refute_match 'hack', io.string + refute_match 'cracked_indicator_for_test', io.string end def test_prevent_response_splitting_cookie_headers_lf - user_input = "malicious\nCookie: hack" + user_input = "malicious\nCookie: cracked_indicator_for_test" res.cookies << WEBrick::Cookie.new('author', user_input) io = StringIO.new res.send_response io io.rewind res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) assert_equal '500', res.code - refute_match 'hack', io.string + refute_match 'cracked_indicator_for_test', io.string end def test_set_redirect_response_splitting - url = "malicious\r\nCookie: hack" + url = "malicious\r\nCookie: cracked_indicator_for_test" assert_raises(URI::InvalidURIError) do res.set_redirect(WEBrick::HTTPStatus::MultipleChoices, url) end