summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJonathan <jonacom@lissismore.com>2021-09-17 12:39:25 -0600
committerHiroshi SHIBATA <hsbt@ruby-lang.org>2021-09-22 10:14:48 +0900
commit13bb16f41edb4682f76d02a9bf2e4d65b443dcf8 (patch)
tree80f36bd2d4dc07e15a1aa6cbef72bfa69c29a6d3
parent42dcac00b156d403f5bde0c9c709bc35a9c8e963 (diff)
[rubygems/rubygems] Fix bug where redacted credentials are sent to server
Implement deep cloning for `Gem::Uri` class to fix a bug where redacting credentials modifies the URI string in place instead of returning a modified copy. https://github.com/rubygems/rubygems/commit/eafb5a279b
-rw-r--r--lib/rubygems/uri.rb9
-rw-r--r--test/rubygems/test_gem_uri.rb7
2 files changed, 16 insertions, 0 deletions
diff --git a/lib/rubygems/uri.rb b/lib/rubygems/uri.rb
index 031d7e01c3..ba30fac2f5 100644
--- a/lib/rubygems/uri.rb
+++ b/lib/rubygems/uri.rb
@@ -43,6 +43,11 @@ class Gem::Uri
@parsed_uri.respond_to?(method_name, include_private) || super
end
+ protected
+
+ # Add a protected reader for the cloned instance to access the original object's parsed uri
+ attr_reader :parsed_uri
+
private
##
@@ -99,4 +104,8 @@ class Gem::Uri
def token?
!user.nil? && password.nil?
end
+
+ def initialize_copy(original)
+ @parsed_uri = original.parsed_uri.clone
+ end
end
diff --git a/test/rubygems/test_gem_uri.rb b/test/rubygems/test_gem_uri.rb
index 0c70443f32..7fe572518b 100644
--- a/test/rubygems/test_gem_uri.rb
+++ b/test/rubygems/test_gem_uri.rb
@@ -29,4 +29,11 @@ class TestUri < Gem::TestCase
def test_redacted_with_invalid_uri
assert_equal "https://www.example.com:80index", Gem::Uri.new("https://www.example.com:80index").redacted.to_s
end
+
+ def test_redacted_does_not_modify_uri
+ url = 'https://user:password@example.com'
+ uri = Gem::Uri.new(url)
+ assert_equal 'https://user:REDACTED@example.com', uri.redacted.to_s
+ assert_equal url, uri.to_s
+ end
end