kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

webrick/httpresponse: set_redirect requires a valid URI

Browse source 
Prevents response splitting and HTML injection attacks in
poorly-written applications which blindly pass along user input
in redirects.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63964 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
normal 2018-07-14 02:59:39 +00:00
parent eb53b0ff05
commit b9f9986a5e
2 changed files with 24 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
lib/webrick/httpresponse.rb
View file

@ -10,6 +10,7 @@
# $IPR: httpresponse.rb,v 1.45 2003/07/11 11:02:25 gotoyuzo Exp $
require 'time'
require 'uri'
require 'webrick/httpversion'
require 'webrick/htmlutils'
require 'webrick/httputils'
@ -331,8 +332,9 @@ module WEBrick
# res.set_redirect WEBrick::HTTPStatus::TemporaryRedirect
def set_redirect(status, url)
url = URI(url).to_s
@body = "<HTML><A HREF=\"#{url}\">#{url}</A>.</HTML>\n"
@header['location'] = url.to_s
@header['location'] = url
raise status
end

21
test/webrick/test_httpresponse.rb
View file

@ -50,6 +50,27 @@ module WEBrick
refute_match 'hack', io.string
end
def test_set_redirect_response_splitting
url = "malicious\r\nCookie: hack"
assert_raises(URI::InvalidURIError) do
res.set_redirect(WEBrick::HTTPStatus::MultipleChoices, url)
end
end
def test_set_redirect_html_injection
url = 'http://example.com////?a</a><head></head><body><img src=1></body>'
assert_raises(WEBrick::HTTPStatus::MultipleChoices) do
res.set_redirect(WEBrick::HTTPStatus::MultipleChoices, url)
end
res.status = 300
io = StringIO.new
res.send_response(io)
io.rewind
res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))
assert_equal '300', res.code
refute_match /<img/, io.string
end
def test_304_does_not_log_warning
res.status = 304
res.setup_header