excon 1.11.0 → 1.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a5b23fd4372baad22a291604ac1177dede89a9e4a8b9caa1aa86019f4893b98d
-  data.tar.gz: 54bb6046bf8e2359a75e6720b9d8d0ffbdb41dbeeea3a483b78d0e58a2653119
+  metadata.gz: 2ff4a819b128bfdfd7a8bca2a4f0d27ee25de1dccc82113edf290831913b3d36
+  data.tar.gz: cffe2d963e403f1a424692d12706b21d8f502902530b6b0c0a7c32d16b558d8c
 SHA512:
-  metadata.gz: 6032a35accee4a3c447c61b2a1d8bac83352b6fd3c2eb18171f59942614983d5b17bcc18f55e051e4280008ff326acc65f93134f2cfb88d6ce18f604dd51b5ac
-  data.tar.gz: 8dfd5595f225591adf29b9d4cba4740825e75b575d894c4a5ebdb3cad468fadefa9b980ca68e7a443a23cb6e04ef72cf457855c760e93b6894f74327674c6b17
+  metadata.gz: bd25fa62f4ad4d735fd8c1f3a9658ec2b59c52170298c315c5ee38068bc4d8155106d2af21337355d83ad63f82ac7359e4c9fcafc9c284f2a1cf3c0e291ad891
+  data.tar.gz: 8115339527863cbfa6b2660001720732d3c52687170e792fd79c89ca6c05f4539b0b00266fc3cb3632b06dfbff371435f7a539cb1305dfbcd66c761974140419

data/lib/excon/connection.rb

@@ -104,7 +104,7 @@ module Excon
         end
       else
         if @data.key?(:host) && @data[:host].nil?
-          raise Excon::Error::InvalidParameter, "host is required for non-Unix connections; " \
+          raise Excon::Error::InvalidHost, "host is required for non-Unix connections; " \
                                                 "the URL may be malformed (e.g. missing \"//\" after the scheme)"
         end
         @socket_key = "#{@data[:scheme]}://#{@data[:host]}#{port_string(@data)}"
@@ -124,16 +124,31 @@ module Excon
           # we already have data from a middleware, so bail
           return datum
         else
+          if include_unsafe_chars?(datum[:host].to_s)
+            raise Excon::Errors::InvalidHost, "host #{datum[:host].inspect} contains unsafe \"\\0\", \"\\n\" or \"\\r\""
+          end
+          if include_unsafe_chars?(datum[:method].to_s)
+            raise Excon::Errors::InvalidMethod, "method #{datum[:method].inspect} contains unsafe \"\\0\", \"\\n\" or \"\\r\""
+          end
+          if include_unsafe_chars?(datum[:path])
+            raise Excon::Errors::InvalidPath, "path #{datum[:path].inspect} contains unsafe \"\\0\", \"\\n\" or \"\\r\""
+          end
+          query = query_string(datum)
+          if include_unsafe_chars?(query)
+            raise Excon::Errors::InvalidQuery, "query contains unsafe \"\\0\", \"\\n\" or \"\\r\""
+          end
+
           socket(datum).data = datum
           # start with "METHOD /path"
           request = datum[:method].to_s.upcase + ' '
           if datum[:proxy] && datum[:scheme] != HTTPS
             request << datum[:scheme] << '://' << datum[:host] << port_string(datum)
           end
+
           request << datum[:path]
 
           # add query to path, if there is one
-          request << query_string(datum)
+          request << query
 
           # finish first line with "HTTP/1.1\r\n"
           request << HTTP_1_1
@@ -197,7 +212,7 @@ module Excon
         end
       rescue => error
         case error
-        when Excon::Errors::InvalidHeaderKey, Excon::Errors::InvalidHeaderValue, Excon::Errors::StubNotFound, Excon::Errors::Timeout
+        when Excon::Errors::InvalidParameter, Excon::Errors::StubNotFound, Excon::Errors::Timeout
           raise(error)
         when Errno::EPIPE
           # Read whatever remains in the pipe to aid in debugging
@@ -272,7 +287,7 @@ module Excon
         datum[:headers][host_key] ||= ''
       else
         if datum[:host].nil?
-          raise Excon::Error::InvalidParameter, "host is required for non-Unix connections; " \
+          raise Excon::Error::InvalidHost, "host is required for non-Unix connections; " \
                                                 "the URL may be malformed (e.g. missing \"//\" after the scheme)"
         end
         datum[:headers][host_key] ||= datum[:host] + port_string(datum)

data/lib/excon/error.rb

@@ -52,9 +52,15 @@ or:
       end
     end
 
-    class InvalidHeaderKey < Error; end
-    class InvalidHeaderValue < Error; end
     class InvalidParameter < Error; end
+
+    class InvalidHeaderKey < InvalidParameter; end
+    class InvalidHeaderValue < InvalidParameter; end
+    class InvalidHost < InvalidParameter; end
+    class InvalidMethod < InvalidParameter; end
+    class InvalidPath < InvalidParameter; end
+    class InvalidQuery < InvalidParameter; end
+
     class Timeout < Error; end
     class ResponseParse < Error; end
 

data/lib/excon/utils.rb

@@ -123,18 +123,23 @@ module Excon
       str.gsub(ESCAPED) { ::Regexp.last_match(1).hex.chr }
     end
 
+    # Detects NUL CR and/or LF as these are unsafe to include without escaping
+    def include_unsafe_chars?(str)
+      str.include?("\0") || str.include?("\n") || str.include?("\r")
+    end
+
     # Performs validation on the passed header hash and returns a string representation of the headers
     def headers_hash_to_s(headers)
       headers_str = +''
       headers.each do |key, values|
-        if key.to_s.match?(/[\r\n]/)
-          raise Excon::Errors::InvalidHeaderKey, "#{key.to_s.inspect} contains forbidden \"\\r\" or \"\\n\""
+        if include_unsafe_chars?(key.to_s)
+          raise Excon::Errors::InvalidHeaderKey, "header key #{key.to_s.inspect} contains unsafe \"\\0\", \"\\n\" or \"\\r\""
         end
 
         [values].flatten.each do |value|
-          if value.to_s.match?(/[\r\n]/)
+          if include_unsafe_chars?(value.to_s)
             # Don't include the potentially sensitive header value (i.e. authorization token) in the message
-            raise Excon::Errors::InvalidHeaderValue, "#{key} header value contains forbidden \"\\r\" or \"\\n\""
+            raise Excon::Errors::InvalidHeaderValue, "header #{key.to_s.inspect} value contains unsafe \"\\0\", \"\\n\" or \"\\r\""
           end
 
           headers_str << key.to_s << ': ' << value.to_s << CR_NL

data/lib/excon/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Excon
-  VERSION = "1.11.0"
+  VERSION = "1.12.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: excon
 version: !ruby/object:Gem::Version
-  version: 1.11.0
+  version: 1.12.0
 platform: ruby
 authors:
 - dpiddy (Dan Peterson)