107 lines
3.6 KiB
Diff
107 lines
3.6 KiB
Diff
From f98b3023bd786b4e7dfdb94b573a5f5d3d37d145 Mon Sep 17 00:00:00 2001
|
|
From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
|
|
Date: Tue, 1 Oct 2019 11:01:05 +0000
|
|
Subject: [PATCH] merge revision(s) 3ce238b5f9795581eb84114dcfbdf4aa086bfecc
|
|
|
|
WEBrick: prevent response splitting and header injection
|
|
|
|
This is a follow up to d9d4a28.
|
|
The commit prevented CRLR, but did not address an isolated CR or an
|
|
isolated LF.
|
|
|
|
Co-Authored-By: NARUSE, Yui <naruse@airemix.jp>
|
|
|
|
|
|
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67813 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
---
|
|
lib/webrick/httpresponse.rb | 3 +-
|
|
test/webrick/test_httpresponse.rb | 46 +++++++++++++++++++++++++++++--
|
|
2 files changed, 46 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb
|
|
index 6d77692140f0..d26324c54a11 100644
|
|
--- a/lib/webrick/httpresponse.rb
|
|
+++ b/lib/webrick/httpresponse.rb
|
|
@@ -367,7 +367,8 @@ def set_error(ex, backtrace=false)
|
|
private
|
|
|
|
def check_header(header_value)
|
|
- if header_value =~ /\r\n/
|
|
+ header_value = header_value.to_s
|
|
+ if /[\r\n]/ =~ header_value
|
|
raise InvalidHeader
|
|
else
|
|
header_value
|
|
diff --git a/test/webrick/test_httpresponse.rb b/test/webrick/test_httpresponse.rb
|
|
index 6263e0a71044..24a6968582e9 100644
|
|
--- a/test/webrick/test_httpresponse.rb
|
|
+++ b/test/webrick/test_httpresponse.rb
|
|
@@ -29,7 +29,7 @@ def setup
|
|
@res.keep_alive = true
|
|
end
|
|
|
|
- def test_prevent_response_splitting_headers
|
|
+ def test_prevent_response_splitting_headers_crlf
|
|
res['X-header'] = "malicious\r\nCookie: hack"
|
|
io = StringIO.new
|
|
res.send_response io
|
|
@@ -39,7 +39,7 @@ def test_prevent_response_splitting_headers
|
|
refute_match 'hack', io.string
|
|
end
|
|
|
|
- def test_prevent_response_splitting_cookie_headers
|
|
+ def test_prevent_response_splitting_cookie_headers_crlf
|
|
user_input = "malicious\r\nCookie: hack"
|
|
res.cookies << WEBrick::Cookie.new('author', user_input)
|
|
io = StringIO.new
|
|
@@ -50,6 +50,48 @@ def test_prevent_response_splitting_cookie_headers
|
|
refute_match 'hack', io.string
|
|
end
|
|
|
|
+ def test_prevent_response_splitting_headers_cr
|
|
+ res['X-header'] = "malicious\rCookie: hack"
|
|
+ io = StringIO.new
|
|
+ res.send_response io
|
|
+ io.rewind
|
|
+ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))
|
|
+ assert_equal '500', res.code
|
|
+ refute_match 'hack', io.string
|
|
+ end
|
|
+
|
|
+ def test_prevent_response_splitting_cookie_headers_cr
|
|
+ user_input = "malicious\rCookie: hack"
|
|
+ res.cookies << WEBrick::Cookie.new('author', user_input)
|
|
+ io = StringIO.new
|
|
+ res.send_response io
|
|
+ io.rewind
|
|
+ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))
|
|
+ assert_equal '500', res.code
|
|
+ refute_match 'hack', io.string
|
|
+ end
|
|
+
|
|
+ def test_prevent_response_splitting_headers_lf
|
|
+ res['X-header'] = "malicious\nCookie: hack"
|
|
+ io = StringIO.new
|
|
+ res.send_response io
|
|
+ io.rewind
|
|
+ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))
|
|
+ assert_equal '500', res.code
|
|
+ refute_match 'hack', io.string
|
|
+ end
|
|
+
|
|
+ def test_prevent_response_splitting_cookie_headers_lf
|
|
+ user_input = "malicious\nCookie: hack"
|
|
+ res.cookies << WEBrick::Cookie.new('author', user_input)
|
|
+ io = StringIO.new
|
|
+ res.send_response io
|
|
+ io.rewind
|
|
+ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))
|
|
+ assert_equal '500', res.code
|
|
+ refute_match 'hack', io.string
|
|
+ end
|
|
+
|
|
def test_304_does_not_log_warning
|
|
res.status = 304
|
|
res.setup_header
|
|
|