diff options
author | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-09-14 11:26:53 +0000 |
---|---|---|
committer | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-09-14 11:26:53 +0000 |
commit | 3896b48678145db3e831566f6c752acd3517dd90 (patch) | |
tree | cfaaa9a6bcd6d9a6e76fb05fdb27a49e162b5346 | |
parent | ac6f2894ea8fd6c9718ececb1245b2b11aae8e82 (diff) |
merge revision(s) 59897:
lib/webrick/log.rb: sanitize any type of logs
It had failed to sanitize some type of exception messages. Reported and
patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@59900 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r-- | ChangeLog | 7 | ||||
-rw-r--r-- | lib/webrick/httpstatus.rb | 4 | ||||
-rw-r--r-- | lib/webrick/log.rb | 4 | ||||
-rw-r--r-- | test/webrick/test_httpauth.rb | 36 | ||||
-rw-r--r-- | version.h | 2 |
5 files changed, 46 insertions, 7 deletions
@@ -1,3 +1,10 @@ +Thu Sep 14 20:25:55 2017 Yusuke Endoh <mame@ruby-lang.org> + + lib/webrick/log.rb: sanitize any type of logs + + It had failed to sanitize some type of exception messages. Reported and + patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363 + Thu Sep 14 13:32:39 2017 Nobuyoshi Nakada <nobu@ruby-lang.org> parse.y: empty hash in defined diff --git a/lib/webrick/httpstatus.rb b/lib/webrick/httpstatus.rb index 8664da26d0..ff9f18203c 100644 --- a/lib/webrick/httpstatus.rb +++ b/lib/webrick/httpstatus.rb @@ -23,10 +23,6 @@ module WEBrick ## # Root of the HTTP status class hierarchy class Status < StandardError - def initialize(*args) # :nodoc: - args[0] = AccessLog.escape(args[0]) unless args.empty? - super(*args) - end class << self attr_reader :code, :reason_phrase # :nodoc: end diff --git a/lib/webrick/log.rb b/lib/webrick/log.rb index 7542d8f79a..41e907cd3b 100644 --- a/lib/webrick/log.rb +++ b/lib/webrick/log.rb @@ -118,10 +118,10 @@ module WEBrick # * Otherwise it will return +arg+.inspect. def format(arg) if arg.is_a?(Exception) - "#{arg.class}: #{arg.message}\n\t" << + "#{arg.class}: #{AccessLog.escape(arg.message)}\n\t" << arg.backtrace.join("\n\t") << "\n" elsif arg.respond_to?(:to_str) - arg.to_str + AccessLog.escape(arg.to_str) else arg.inspect end diff --git a/test/webrick/test_httpauth.rb b/test/webrick/test_httpauth.rb index 4376b91842..5560740b5f 100644 --- a/test/webrick/test_httpauth.rb +++ b/test/webrick/test_httpauth.rb @@ -98,6 +98,42 @@ class TestWEBrickHTTPAuth < Test::Unit::TestCase } end + def test_bad_username_with_control_characters + log_tester = lambda {|log, access_log| + assert_equal(2, log.length) + assert_match(/ERROR Basic WEBrick's realm: foo\\ebar: the user is not allowed./, log[0]) + assert_match(/ERROR WEBrick::HTTPStatus::Unauthorized/, log[1]) + } + TestWEBrick.start_httpserver({}, log_tester) {|server, addr, port, log| + realm = "WEBrick's realm" + path = "/basic_auth" + + Tempfile.create("test_webrick_auth") {|tmpfile| + tmpfile.close + tmp_pass = WEBrick::HTTPAuth::Htpasswd.new(tmpfile.path) + tmp_pass.set_passwd(realm, "webrick", "supersecretpassword") + tmp_pass.set_passwd(realm, "foo", "supersecretpassword") + tmp_pass.flush + + htpasswd = WEBrick::HTTPAuth::Htpasswd.new(tmpfile.path) + users = [] + htpasswd.each{|user, pass| users << user } + server.mount_proc(path){|req, res| + auth = WEBrick::HTTPAuth::BasicAuth.new( + :Realm => realm, :UserDB => htpasswd, + :Logger => server.logger + ) + auth.authenticate(req, res) + res.body = "hoge" + } + http = Net::HTTP.new(addr, port) + g = Net::HTTP::Get.new(path) + g.basic_auth("foo\ebar", "passwd") + http.request(g){|res| assert_not_equal("hoge", res.body, log.call) } + } + } + end + DIGESTRES_ = / ([a-zA-Z\-]+) [ \t]*(?:\r\n[ \t]*)* @@ -1,6 +1,6 @@ #define RUBY_VERSION "2.3.5" #define RUBY_RELEASE_DATE "2017-09-14" -#define RUBY_PATCHLEVEL 375 +#define RUBY_PATCHLEVEL 376 #define RUBY_RELEASE_YEAR 2017 #define RUBY_RELEASE_MONTH 9 |