mirror of
https://git.yoctoproject.org/poky
synced 2026-02-12 11:43:04 +01:00
7ad1d26688
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27221 Upstream-patches:36754948392789182478(From OE-Core rev: 421d7011269f4750f5942b815d68f77fa4559d69) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
58 lines
2.0 KiB
Diff
58 lines
2.0 KiB
Diff
From 3675494839112b64d5f082a9068237b277ed1495 Mon Sep 17 00:00:00 2001
|
|
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
|
Date: Fri, 21 Feb 2025 16:29:36 +0900
|
|
Subject: [PATCH] Truncate userinfo with URI#join, URI#merge and URI#+
|
|
|
|
CVE: CVE-2025-27221
|
|
|
|
Upstream-Status: Backport [https://github.com/ruby/uri/commit/3675494839112b64d5f082a9068237b277ed1495]
|
|
|
|
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
|
---
|
|
lib/uri/generic.rb | 6 +++++-
|
|
test/uri/test_generic.rb | 11 +++++++++++
|
|
2 files changed, 16 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb
|
|
index f3540a2..ecc78c5 100644
|
|
--- a/lib/uri/generic.rb
|
|
+++ b/lib/uri/generic.rb
|
|
@@ -1141,7 +1141,11 @@ module URI
|
|
end
|
|
|
|
# RFC2396, Section 5.2, 7)
|
|
- base.set_userinfo(rel.userinfo) if rel.userinfo
|
|
+ if rel.userinfo
|
|
+ base.set_userinfo(rel.userinfo)
|
|
+ else
|
|
+ base.set_userinfo(nil)
|
|
+ end
|
|
base.set_host(rel.host) if rel.host
|
|
base.set_port(rel.port) if rel.port
|
|
base.query = rel.query if rel.query
|
|
diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb
|
|
index e661937..17ba2b6 100644
|
|
--- a/test/uri/test_generic.rb
|
|
+++ b/test/uri/test_generic.rb
|
|
@@ -164,6 +164,17 @@ class URI::TestGeneric < Test::Unit::TestCase
|
|
# must be empty string to identify as path-abempty, not path-absolute
|
|
assert_equal('', url.host)
|
|
assert_equal('http:////example.com', url.to_s)
|
|
+
|
|
+ # sec-2957667
|
|
+ url = URI.parse('http://user:pass@example.com').merge('//example.net')
|
|
+ assert_equal('http://example.net', url.to_s)
|
|
+ assert_nil(url.userinfo)
|
|
+ url = URI.join('http://user:pass@example.com', '//example.net')
|
|
+ assert_equal('http://example.net', url.to_s)
|
|
+ assert_nil(url.userinfo)
|
|
+ url = URI.parse('http://user:pass@example.com') + '//example.net'
|
|
+ assert_equal('http://example.net', url.to_s)
|
|
+ assert_nil(url.userinfo)
|
|
end
|
|
|
|
def test_parse_scheme_with_symbols
|
|
--
|
|
2.40.0
|
|
|