[ruby/uri] Truncate userinfo with URI#join, URI#merge and URI#+

https://github.com/ruby/uri/commit/3675494839

1 files changed, 11 insertions, 0 deletions

diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb
index 8209363b82..4b04998490 100644
--- a/test/uri/test_generic.rb
+++ b/test/uri/test_generic.rb
@@ -175,6 +175,17 @@ class URI::TestGeneric < Test::Unit::TestCase
     # must be empty string to identify as path-abempty, not path-absolute
     assert_equal('', url.host)
     assert_equal('http:////example.com', url.to_s)
+
+    # sec-2957667
+    url = URI.parse('http://user:pass@example.com').merge('//example.net')
+    assert_equal('http://example.net', url.to_s)
+    assert_nil(url.userinfo)
+    url = URI.join('http://user:pass@example.com', '//example.net')
+    assert_equal('http://example.net', url.to_s)
+    assert_nil(url.userinfo)
+    url = URI.parse('http://user:pass@example.com') + '//example.net'
+    assert_equal('http://example.net', url.to_s)
+    assert_nil(url.userinfo)
   end
 
   def test_parse_scheme_with_symbols