faraday 2.14.0 → 2.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2fc5e44f27171827ea964dee68999e7d9ae6cd4d952a0a8ad0600e155cdf3892
-  data.tar.gz: 88c85684e7d9acb7978b36d20f2041145441f99e7705e6cf8f41483ed620dadc
+  metadata.gz: 8d5ef64533c80aaabadd55b5ea342b102fd652f5918039c7deff3b26c4ad4a67
+  data.tar.gz: 81ebbac6eb08b7f85ee7d8673e3274bbe110c0a865604a3df7294814ba469eb8
 SHA512:
-  metadata.gz: 972d764f70f42d46e01ef8c8a33aab692619b8adc1793f07ed031cc7cd09ad6d749d5948d25f4e9e8c6b83377bfa2a25eda1e80eb79d086bae93d90959e321bd
-  data.tar.gz: b9b7b80f59d02b813ae99ba5afd3cbaf517953f208f2cfc91347bdbec1f4112d4b508c22721f65ac607b45a47507d7adc97cbe7cf08b3d0c56ad0c7dc1b0af5e
+  metadata.gz: 50080c6a64a9c7b0775da8c3d63ece38a3e0946f36500665ee9be6fc547fc1a5313897ffe87fb1f08f802b6a69b8b11f46fb3a2a751ba8c00aab6910cebadbb4
+  data.tar.gz: '093b793d6b3f0ca6951a4c71ffd1f4b2603a1ea7d6efce304b165ae8124dd7cb64f7aa46b455a0ee5c9ba8e0f91ec931484dcdd7d2082dbae64448ee7aa6b2d7'

data/lib/faraday/connection.rb

@@ -481,8 +481,9 @@ module Faraday
       if url && !base.path.end_with?('/')
         base.path = "#{base.path}/" # ensure trailing slash
       end
-      # Ensure relative url will be parsed correctly (such as `service:search` )
-      url = "./#{url}" if url.respond_to?(:start_with?) && !url.start_with?('http://', 'https://', '/', './', '../')
+      # Ensure relative url will be parsed correctly (such as `service:search` or `//evil.com`)
+      url = "./#{url}" if url.respond_to?(:start_with?) &&
+                          (!url.start_with?('http://', 'https://', '/', './', '../') || url.start_with?('//'))
       uri = url ? base + url : base
       if params
         uri.query = params.to_query(params_encoder || options.params_encoder)

data/lib/faraday/logging/formatter.rb

@@ -63,7 +63,7 @@ module Faraday
 
       def dump_body(body)
         if body.respond_to?(:to_str)
-          body.to_str.encode(Encoding::UTF_8, undef: :replace, invalid: :replace)
+          body.to_str.encode(::Encoding::UTF_8, undef: :replace, invalid: :replace)
         else
           pretty_inspect(body)
         end

data/lib/faraday/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Faraday
-  VERSION = '2.14.0'
+  VERSION = '2.14.1'
 end

data/spec/faraday/connection_spec.rb

@@ -311,6 +311,39 @@ RSpec.describe Faraday::Connection do
       end
     end
 
+    context 'with protocol-relative URL (GHSA-33mh-2634-fwr2)' do
+      it 'does not allow host override with //evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //evil.com:8080/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//evil.com:8080/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with //user:pass@evil.com/path' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('//user:pass@evil.com/path')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'does not allow host override with ///evil.com' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('///evil.com')
+        expect(uri.host).to eq('httpbingo.org')
+      end
+
+      it 'still allows single-slash absolute paths' do
+        conn.url_prefix = 'http://httpbingo.org/api'
+        uri = conn.build_exclusive_url('/safe/path')
+        expect(uri.host).to eq('httpbingo.org')
+        expect(uri.path).to eq('/safe/path')
+      end
+    end
+
     context 'with a custom `default_uri_parser`' do
       let(:url) { 'http://httpbingo.org' }
       let(:parser) { Addressable::URI }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: faraday
 version: !ruby/object:Gem::Version
-  version: 2.14.0
+  version: 2.14.1
 platform: ruby
 authors:
 - "@technoweenie"
@@ -144,7 +144,7 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://lostisland.github.io/faraday
-  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v2.14.0
+  changelog_uri: https://github.com/lostisland/faraday/releases/tag/v2.14.1
   source_code_uri: https://github.com/lostisland/faraday
   bug_tracker_uri: https://github.com/lostisland/faraday/issues
   rubygems_mfa_required: 'true'