summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorusa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2021-07-07 10:38:10 +0000
committerusa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2021-07-07 10:38:10 +0000
commit95ba9053e20ad8d113af37b3f1f4cbfff1f6a8f1 (patch)
tree564f37341ebbc51b3f4b0117d8a30ac0e40c8aa8
parentbe5a83e84a34091f2a4e3c6dfb911b20e78e690c (diff)
Fix StartTLS stripping vulnerabilityruby_2_6
Reported by Alexandr Savca in https://hackerone.com/reports/1178562 Co-authored-by: Shugo Maeda <shugo@ruby-lang.org> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--lib/net/imap.rb8
-rw-r--r--test/net/imap/test_imap.rb39
-rw-r--r--version.h2
3 files changed, 47 insertions, 2 deletions
diff --git a/lib/net/imap.rb b/lib/net/imap.rb
index 1c7e89ba145..91df89b79eb 100644
--- a/lib/net/imap.rb
+++ b/lib/net/imap.rb
@@ -1215,12 +1215,14 @@ module Net
end
resp = @tagged_responses.delete(tag)
case resp.name
+ when /\A(?:OK)\z/ni
+ return resp
when /\A(?:NO)\z/ni
raise NoResponseError, resp
when /\A(?:BAD)\z/ni
raise BadResponseError, resp
else
- return resp
+ raise UnknownResponseError, resp
end
end
@@ -3716,6 +3718,10 @@ module Net
class ByeResponseError < ResponseError
end
+ # Error raised upon an unknown response from the server.
+ class UnknownResponseError < ResponseError
+ end
+
RESPONSE_ERRORS = Hash.new(ResponseError)
RESPONSE_ERRORS["NO"] = NoResponseError
RESPONSE_ERRORS["BAD"] = BadResponseError
diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb
index 936f4e0f42a..81928cb8fe9 100644
--- a/test/net/imap/test_imap.rb
+++ b/test/net/imap/test_imap.rb
@@ -127,6 +127,24 @@ class IMAPTest < Test::Unit::TestCase
imap.disconnect
end
end
+
+ def test_starttls_stripping
+ starttls_stripping_test do |port|
+ imap = Net::IMAP.new("localhost", :port => port)
+ assert_raise(Net::IMAP::UnknownResponseError) do
+ imap.starttls(:ca_file => CA_FILE)
+ end
+ imap
+ end
+ end
+ end
+
+ def start_server
+ th = Thread.new do
+ yield
+ end
+ @threads << th
+ sleep 0.1 until th.stop?
end
def test_unexpected_eof
@@ -762,6 +780,27 @@ EOF
end
end
+ def starttls_stripping_test
+ server = create_tcp_server
+ port = server.addr[1]
+ start_server do
+ sock = server.accept
+ begin
+ sock.print("* OK test server\r\n")
+ sock.gets
+ sock.print("RUBY0001 BUG unhandled command\r\n")
+ ensure
+ sock.close
+ server.close
+ end
+ end
+ begin
+ imap = yield(port)
+ ensure
+ imap.disconnect if imap && !imap.disconnected?
+ end
+ end
+
def create_tcp_server
return TCPServer.new(server_addr, 0)
end
diff --git a/version.h b/version.h
index 668fd5da227..89eacefb544 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
#define RUBY_VERSION "2.6.8"
#define RUBY_RELEASE_DATE "2021-07-07"
-#define RUBY_PATCHLEVEL 204
+#define RUBY_PATCHLEVEL 205
#define RUBY_RELEASE_YEAR 2021
#define RUBY_RELEASE_MONTH 7