faraday 1.10.4 → 1.10.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41cebae56fde7ef704543fcb80cc60c1c69694e540489d03d3882d5b3776c056
-  data.tar.gz: 70069a1f1e36c058c982987914910fa6563dcbaad08a6278295d5bd754b72fee
+  metadata.gz: efc660709daf1320a9c5da2a957444e0bfab26fd8ee011f949b324c915083018
+  data.tar.gz: 2579fcc8e6470a92fd973b9472e1e746ef482000a6c013d04e8e607f9cd1b3e0
 SHA512:
-  metadata.gz: bbf15956af42768f1df10f6677b455e8c43def534d1510f85a4b5a6e9c32896f37cea2ce6d927f2cd84e4b26967d95705a71f05e6ae85f638f27a3487d44b596
-  data.tar.gz: 1eab4e96fe13971b7144121d93963fb49140ef16725987f5f778f64182bdaace0024742b24c6a6965b5d127d613e2992bc949256d0eacecd346275efe4dc4809
+  metadata.gz: 99a0d80605467ff74c10abc92fab4aba09972e71319e2f8112ae3b064b323be0f2c0b9e4a68090e4181daa68a8e7e1e58546a886e0a6b4570ef7c292bc8ceb02
+  data.tar.gz: 0c17e2e5471b0ceaa5b60912ecaa3396bdd720da239939956cdf67c71be8d2c379df8ec425db3af823a6fd26b3bc3228f84297dc4ff8a0d7aba7e039fb000354

data/lib/faraday/connection.rb

@@ -545,6 +545,8 @@ module Faraday
       if url && base.path && base.path !~ %r{/$}
         base.path = "#{base.path}/" # ensure trailing slash
       end
+      # Ensure protocol-relative URLs are handled correctly (CVE-2026-25765)
+      url = "./#{url}" if url.respond_to?(:start_with?) && url.start_with?('//')
       url = url && URI.parse(url.to_s).opaque ? url.to_s.gsub(':', '%3A') : url
       uri = url ? base + url : base
       if params

data/lib/faraday/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Faraday
-  VERSION = '1.10.4'
+  VERSION = '1.10.5'
 end

data/spec/faraday/connection_spec.rb

@@ -307,6 +307,39 @@ RSpec.describe Faraday::Connection do
         expect(uri.to_s).to eq('http://service.com/api/service%3Asearch?limit=400')
       end
     end
+
+    context 'with protocol-relative URL (CVE-2026-25765)' do
+      it 'does not allow host override with //evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //evil.com:8080/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com:8080/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //user:pass@evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//user:pass@evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with ///evil.com' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('///evil.com')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'still allows single-slash absolute paths' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('/safe/path')
+        expect(uri.host).to eq('httpbingo.org')
+        expect(uri.path).to eq('/safe/path')
+      end
+    end
   end
 
   describe '#build_url' do

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: faraday
 version: !ruby/object:Gem::Version
-  version: 1.10.4
+  version: 1.10.5
 platform: ruby
 authors:
 - "@technoweenie"
 - "@iMacTia"
 - "@olleolleolle"
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-09-20 00:00:00.000000000 Z
+date: 2026-02-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday-em_http
@@ -166,7 +166,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.0.4
-description: 
+description:
 email: technoweenie@gmail.com
 executables: []
 extensions: []
@@ -268,10 +268,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://lostisland.github.io/faraday
-  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v1.10.4
+  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v1.10.5
   source_code_uri: https://github.com/lostisland/faraday
   bug_tracker_uri: https://github.com/lostisland/faraday/issues
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -288,7 +288,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: HTTP/REST API client library.
 test_files: []