54 lines
1.8 KiB
Diff
54 lines
1.8 KiB
Diff
|
From 4263c0d15a582b46d75aac57cd26a47d33941a53 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
||
|
|
Date: Fri, 21 Feb 2025 16:29:36 +0900
|
||
|
|
Subject: [PATCH] Truncate userinfo with URI#join, URI#merge and URI#+
|
||
|
|
|
||
|
|
---
|
||
|
|
lib/uri/generic.rb | 6 +++++-
|
||
|
|
test/uri/test_generic.rb | 11 +++++++++++
|
||
|
|
2 files changed, 16 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb
|
||
|
|
index 69698c4..7d0b889 100644
|
||
|
|
--- a/lib/uri/generic.rb
|
||
|
|
+++ b/lib/uri/generic.rb
|
||
|
|
@@ -1141,7 +1141,11 @@ module URI
|
||
|
|
end
|
||
|
|
|
||
|
|
# RFC2396, Section 5.2, 7)
|
||
|
|
- base.set_userinfo(rel.userinfo) if rel.userinfo
|
||
|
|
+ if rel.userinfo
|
||
|
|
+ base.set_userinfo(rel.userinfo)
|
||
|
|
+ else
|
||
|
|
+ base.set_userinfo(nil)
|
||
|
|
+ end
|
||
|
|
base.set_host(rel.host) if rel.host
|
||
|
|
base.set_port(rel.port) if rel.port
|
||
|
|
base.query = rel.query if rel.query
|
||
|
|
diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb
|
||
|
|
index 3897c3d..30f9cbf 100644
|
||
|
|
--- a/test/uri/test_generic.rb
|
||
|
|
+++ b/test/uri/test_generic.rb
|
||
|
|
@@ -164,6 +164,17 @@ class URI::TestGeneric < Test::Unit::TestCase
|
||
|
|
# must be empty string to identify as path-abempty, not path-absolute
|
||
|
|
assert_equal('', url.host)
|
||
|
|
assert_equal('http:////example.com', url.to_s)
|
||
|
|
+
|
||
|
|
+ # sec-2957667
|
||
|
|
+ url = URI.parse('http://user:pass@example.com').merge('//example.net')
|
||
|
|
+ assert_equal('http://example.net', url.to_s)
|
||
|
|
+ assert_nil(url.userinfo)
|
||
|
|
+ url = URI.join('http://user:pass@example.com', '//example.net')
|
||
|
|
+ assert_equal('http://example.net', url.to_s)
|
||
|
|
+ assert_nil(url.userinfo)
|
||
|
|
+ url = URI.parse('http://user:pass@example.com') + '//example.net'
|
||
|
|
+ assert_equal('http://example.net', url.to_s)
|
||
|
|
+ assert_nil(url.userinfo)
|
||
|
|
end
|
||
|
|
|
||
|
|
def test_parse_scheme_with_symbols
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|
||
|
|
|