kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Check for invalid hex escapes in URI#query=

Browse source 
Fixes [Bug #11275]
This commit is contained in:
Jeremy Evans 2019-07-05 14:45:19 -07:00
parent 8feb8c9bb7
commit 7909f06212
Notes: git 2019-10-08 23:31:25 +09:00
2 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
lib/uri/generic.rb
View file

@ -836,6 +836,7 @@ module URI
v.encode!(Encoding::UTF_8) rescue nil
v.delete!("\t\r\n")
v.force_encoding(Encoding::ASCII_8BIT)
raise InvalidURIError, "invalid percent escape: #{$1}" if /(%\H\H)/n.match(v)
v.gsub!(/(?!%\h\h|[!$-&(-;=?-_a-~])./n.freeze){'%%%02X' % $&.ord}
v.force_encoding(Encoding::US_ASCII)
@query = v

5
test/uri/test_parser.rb
View file

@ -40,6 +40,11 @@ class URI::TestParser < Test::Unit::TestCase
uri_to_ary(u1))
end
def test_parse_query_pct_encoded
assert_equal('q=%32!$&-/?.09;=:@AZ_az~', URI.parse('https://www.example.com/search?q=%32!$&-/?.09;=:@AZ_az~').query)
assert_raise(URI::InvalidURIError) { URI.parse('https://www.example.com/search?q=%XX') }
end
def test_raise_bad_uri_for_integer
assert_raise(URI::InvalidURIError) do
URI.parse(1)