mirror of
https://git.yoctoproject.org/poky
synced 2026-03-10 01:09:40 +01:00
32d2b233c6
In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because userinfo is retained even after changing the host. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27221 Upstream-patches:36754948392789182478(From OE-Core rev: c77ff1288719d90ef257dfe28cb33b3768fc124a) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
74 lines
2.3 KiB
Diff
74 lines
2.3 KiB
Diff
From 2789182478f42ccbb62197f952eb730e4f02bfc5 Mon Sep 17 00:00:00 2001
|
|
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
|
Date: Fri, 21 Feb 2025 18:16:28 +0900
|
|
Subject: [PATCH] Fix merger of URI with authority component
|
|
|
|
https://hackerone.com/reports/2957667
|
|
|
|
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
|
|
|
|
CVE: CVE-2025-27221
|
|
|
|
Upstream-Status: Backport [https://github.com/ruby/uri/commit/2789182478f42ccbb62197f952eb730e4f02bfc5]
|
|
|
|
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
|
---
|
|
lib/uri/generic.rb | 19 +++++++------------
|
|
test/uri/test_generic.rb | 7 +++++++
|
|
2 files changed, 14 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb
|
|
index 23d2398..2420882 100644
|
|
--- a/lib/uri/generic.rb
|
|
+++ b/lib/uri/generic.rb
|
|
@@ -1123,21 +1123,16 @@ module URI
|
|
base.fragment=(nil)
|
|
|
|
# RFC2396, Section 5.2, 4)
|
|
- if !authority
|
|
- base.set_path(merge_path(base.path, rel.path)) if base.path && rel.path
|
|
- else
|
|
- # RFC2396, Section 5.2, 4)
|
|
- base.set_path(rel.path) if rel.path
|
|
+ if authority
|
|
+ base.set_userinfo(rel.userinfo)
|
|
+ base.set_host(rel.host)
|
|
+ base.set_port(rel.port || base.default_port)
|
|
+ base.set_path(rel.path)
|
|
+ elsif base.path && rel.path
|
|
+ base.set_path(merge_path(base.path, rel.path))
|
|
end
|
|
|
|
# RFC2396, Section 5.2, 7)
|
|
- if rel.userinfo
|
|
- base.set_userinfo(rel.userinfo)
|
|
- else
|
|
- base.set_userinfo(nil)
|
|
- end
|
|
- base.set_host(rel.host) if rel.host
|
|
- base.set_port(rel.port) if rel.port
|
|
base.query = rel.query if rel.query
|
|
base.fragment=(rel.fragment) if rel.fragment
|
|
|
|
diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb
|
|
index b74f8e6..ade0294 100644
|
|
--- a/test/uri/test_generic.rb
|
|
+++ b/test/uri/test_generic.rb
|
|
@@ -260,6 +260,13 @@ class URI::TestGeneric < Test::Unit::TestCase
|
|
assert_equal(u0, u1)
|
|
end
|
|
|
|
+ def test_merge_authority
|
|
+ u = URI.parse('http://user:pass@example.com:8080')
|
|
+ u0 = URI.parse('http://new.example.org/path')
|
|
+ u1 = u.merge('//new.example.org/path')
|
|
+ assert_equal(u0, u1)
|
|
+ end
|
|
+
|
|
def test_route
|
|
url = URI.parse('http://hoge/a.html').route_to('http://hoge/b.html')
|
|
assert_equal('b.html', url.to_s)
|
|
--
|
|
2.40.0
|
|
|