diff options
author | Yusuke Endoh <mame@ruby-lang.org> | 2021-07-07 12:06:44 +0900 |
---|---|---|
committer | NAKAMURA Usaku <usa@ruby-lang.org> | 2021-07-07 19:48:22 +0900 |
commit | a21a3b7d23704a01d34bd79d09dc37897e00922a (patch) | |
tree | a1d36058ca888abfa21236478b81de7dc0d387ba /test/net/imap/test_imap.rb | |
parent | 3ca1399150ed4eacfd2fe1ee251b966f8d1ee469 (diff) |
Fix StartTLS stripping vulnerabilityv2_7_4
Reported by Alexandr Savca in https://hackerone.com/reports/1178562
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
Diffstat (limited to 'test/net/imap/test_imap.rb')
-rw-r--r-- | test/net/imap/test_imap.rb | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb index 33b305e116..0ce0eb67ba 100644 --- a/test/net/imap/test_imap.rb +++ b/test/net/imap/test_imap.rb @@ -127,6 +127,16 @@ class IMAPTest < Test::Unit::TestCase imap.disconnect end end + + def test_starttls_stripping + starttls_stripping_test do |port| + imap = Net::IMAP.new("localhost", :port => port) + assert_raise(Net::IMAP::UnknownResponseError) do + imap.starttls(:ca_file => CA_FILE) + end + imap + end + end end def start_server @@ -784,6 +794,27 @@ EOF end end + def starttls_stripping_test + server = create_tcp_server + port = server.addr[1] + start_server do + sock = server.accept + begin + sock.print("* OK test server\r\n") + sock.gets + sock.print("RUBY0001 BUG unhandled command\r\n") + ensure + sock.close + server.close + end + end + begin + imap = yield(port) + ensure + imap.disconnect if imap && !imap.disconnected? + end + end + def create_tcp_server return TCPServer.new(server_addr, 0) end |