faraday 1.10.4 → 1.10.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41cebae56fde7ef704543fcb80cc60c1c69694e540489d03d3882d5b3776c056
-  data.tar.gz: 70069a1f1e36c058c982987914910fa6563dcbaad08a6278295d5bd754b72fee
+  metadata.gz: 6c99ff059f5fdb0926b754a976809c5fe7db068c288a1ac5e0c3d70c26986f6f
+  data.tar.gz: 1ca17845876218b7d70805f8898da7fa1c520dc37030ccadbc3753d0f92866a0
 SHA512:
-  metadata.gz: bbf15956af42768f1df10f6677b455e8c43def534d1510f85a4b5a6e9c32896f37cea2ce6d927f2cd84e4b26967d95705a71f05e6ae85f638f27a3487d44b596
-  data.tar.gz: 1eab4e96fe13971b7144121d93963fb49140ef16725987f5f778f64182bdaace0024742b24c6a6965b5d127d613e2992bc949256d0eacecd346275efe4dc4809
+  metadata.gz: 7b5206b7e57f8ab2755de596c244807ed990067c240e23d18cf9a613a948edd0d83d131aa95eb79ec55a83787b0a360615ed0abf2cbc7a9ef27ddb45ae458150
+  data.tar.gz: d86797dcf2c0f154dbf8f4ad557665d8cd4f3b86940e15480cc107151fa2d7db8a8efd081dc1a9ae3e56303d7ecdba6fc373c380e5b5e0e32d6cb7c453a6e437

data/lib/faraday/connection.rb

@@ -545,6 +545,8 @@ module Faraday
       if url && base.path && base.path !~ %r{/$}
         base.path = "#{base.path}/" # ensure trailing slash
       end
+      # Ensure protocol-relative URLs are handled correctly (CVE-2026-25765)
+      url = "./#{url}" if url.respond_to?(:start_with?) && url.start_with?('//')
       url = url && URI.parse(url.to_s).opaque ? url.to_s.gsub(':', '%3A') : url
       uri = url ? base + url : base
       if params

data/lib/faraday/encoders/nested_params_encoder.rb

@@ -100,6 +100,8 @@ module Faraday
 
     def decode_pair(key, value, context)
       subkeys = key.scan(SUBKEYS_REGEX)
+      validate_params_depth!(subkeys.length)
+
       subkeys.each_with_index do |subkey, i|
         is_array = subkey =~ /[\[\]]+\Z/
         subkey = $` if is_array
@@ -139,6 +141,12 @@ module Faraday
       is_array ? context << value : context[subkey] = value
     end
 
+    def validate_params_depth!(depth)
+      return unless @param_depth_limit && depth > @param_depth_limit
+
+      raise Faraday::Error, "exceeded nested parameter depth limit of #{@param_depth_limit}"
+    end
+
     # Internal: convert a nested hash with purely numeric keys into an array.
     # FIXME: this is not compatible with Rack::Utils.parse_nested_query
     # @!visibility private
@@ -161,7 +169,7 @@ module Faraday
   # for your requests.
   module NestedParamsEncoder
     class << self
-      attr_accessor :sort_params
+      attr_accessor :sort_params, :param_depth_limit
 
       extend Forwardable
       def_delegators :'Faraday::Utils', :escape, :unescape
@@ -169,6 +177,7 @@ module Faraday
 
     # Useful default for OAuth and caching.
     @sort_params = true
+    @param_depth_limit = 100
 
     extend EncodeMethods
     extend DecodeMethods

data/lib/faraday/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Faraday
-  VERSION = '1.10.4'
+  VERSION = '1.10.6'
 end

data/spec/faraday/connection_spec.rb

@@ -307,6 +307,39 @@ RSpec.describe Faraday::Connection do
         expect(uri.to_s).to eq('http://service.com/api/service%3Asearch?limit=400')
       end
     end
+
+    context 'with protocol-relative URL (CVE-2026-25765)' do
+      it 'does not allow host override with //evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //evil.com:8080/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com:8080/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //user:pass@evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//user:pass@evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with ///evil.com' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('///evil.com')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'still allows single-slash absolute paths' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('/safe/path')
+        expect(uri.host).to eq('httpbingo.org')
+        expect(uri.path).to eq('/safe/path')
+      end
+    end
   end
 
   describe '#build_url' do
@@ -322,6 +355,19 @@ RSpec.describe Faraday::Connection do
       url = conn.build_url(nil, b: 2, c: 3)
       expect(url.to_s).to eq('http://sushi.com/nigiri?a=1&b=2&c=3')
     end
+
+    it 'raises a controlled error when URL query params exceed the nested depth limit' do
+      original_param_depth_limit = Faraday::NestedParamsEncoder.param_depth_limit
+      begin
+        Faraday::NestedParamsEncoder.param_depth_limit = 2
+        expect { conn.build_url('/nigiri?a[b][c]=1') }.to raise_error(
+          Faraday::Error,
+          'exceeded nested parameter depth limit of 2'
+        )
+      ensure
+        Faraday::NestedParamsEncoder.param_depth_limit = original_param_depth_limit
+      end
+    end
   end
 
   describe '#build_request' do

data/spec/faraday/params_encoders/nested_spec.rb

@@ -5,6 +5,15 @@ require 'rack/utils'
 RSpec.describe Faraday::NestedParamsEncoder do
   it_behaves_like 'a params encoder'
 
+  around do |example|
+    original_param_depth_limit = described_class.param_depth_limit
+    begin
+      example.run
+    ensure
+      described_class.param_depth_limit = original_param_depth_limit
+    end
+  end
+
   it 'decodes arrays' do
     query    = 'a[1]=one&a[2]=two&a[3]=three'
     expected = { 'a' => %w[one two three] }
@@ -59,6 +68,27 @@ RSpec.describe Faraday::NestedParamsEncoder do
     expect(subject.decode(query)).to eq(expected)
   end
 
+  it 'allows nested params within the configured depth limit' do
+    described_class.param_depth_limit = 3
+
+    expect(subject.decode('a[b][c]=1')).to eq({ 'a' => { 'b' => { 'c' => '1' } } })
+  end
+
+  it 'raises a controlled error when nested params exceed the depth limit' do
+    described_class.param_depth_limit = 2
+
+    expect { subject.decode('a[b][c]=1') }.to raise_error(
+      Faraday::Error,
+      'exceeded nested parameter depth limit of 2'
+    )
+  end
+
+  it 'allows disabling the nested params depth limit' do
+    described_class.param_depth_limit = nil
+
+    expect(subject.decode('a[b][c][d]=1')).to eq({ 'a' => { 'b' => { 'c' => { 'd' => '1' } } } })
+  end
+
   it 'encodes rack compat' do
     params   = { a: [{ one: '1', two: '2' }, '3', ''] }
     result   = Faraday::Utils.unescape(Faraday::NestedParamsEncoder.encode(params)).split('&')

data/spec/faraday_spec.rb

@@ -18,10 +18,14 @@ RSpec.describe Faraday do
     end
 
     it 'uses method_missing on Faraday if there is no proxyable method' do
-      expect { Faraday.this_method_does_not_exist }.to raise_error(
-        NoMethodError,
-        "undefined method `this_method_does_not_exist' for Faraday:Module"
-      )
+      expected_message =
+        if RUBY_VERSION >= '3.3'
+          "undefined method `this_method_does_not_exist' for module Faraday"
+        else
+          "undefined method `this_method_does_not_exist' for Faraday:Module"
+        end
+
+      expect { Faraday.this_method_does_not_exist }.to raise_error(NoMethodError, expected_message)
     end
 
     it 'proxied methods can be accessed' do

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: faraday
 version: !ruby/object:Gem::Version
-  version: 1.10.4
+  version: 1.10.6
 platform: ruby
 authors:
 - "@technoweenie"
 - "@iMacTia"
 - "@olleolleolle"
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-20 00:00:00.000000000 Z
+date: 2026-06-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday-em_http
@@ -166,7 +166,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.0.4
-description: 
+description:
 email: technoweenie@gmail.com
 executables: []
 extensions: []
@@ -268,10 +268,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://lostisland.github.io/faraday
-  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v1.10.4
+  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v1.10.6
   source_code_uri: https://github.com/lostisland/faraday
   bug_tracker_uri: https://github.com/lostisland/faraday/issues
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -288,7 +288,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: HTTP/REST API client library.
 test_files: []