gocardless_pro 4.16.0 → 4.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2d65d236ad3d172135d059974b555d35b0bb435707e7577255fd01c653953e62
-  data.tar.gz: 98f22a67f30a5d41f777a7f8793221ec77da6cb3cf823a615f42ef88c3af8fa0
+  metadata.gz: 5b9d2dd26df920771e2ba47eb3c4d6adc895d27ef93e88e1ae94d0fa8422a653
+  data.tar.gz: caf7afa2dae19d07abd11037d3d58d6a33d245fcafb2944d4df36270de62e184
 SHA512:
-  metadata.gz: b61a81df21d0ad24ae08ed30a1b6d0085d2604e24a678ec967ad68bfde342112590f326083a394a7a51bb2712761c58a8db54cb45a6f09556de6740ec0bc6e4d
-  data.tar.gz: 63f9d6326253bc5046f2f677d5e1e92d43f979261a75c679d2dc5a0fe62ff1108180dd506a820f1965f48964f386e6111841d718b03a60e42b4618496367d079
+  metadata.gz: 81d1de6bacdbf95c038b152df47b141fa72871f9f241e5c18b4fcc06553188796d1d5721c6694f91d60f3ff4bd672de02de834b64abee2521c0652b40477735e
+  data.tar.gz: c4392b0daee5b4845db700778f10da3aec0c69f126c5dd7b3dc14c07d3eadd94ed24d25a1dc02f1fc063998b52dd8a3550328d9ebef341bb6110c68c5f566641

data/lib/gocardless_pro/api_service.rb

@@ -48,7 +48,7 @@ module GoCardlessPro
 
       options[:headers] ||= {}
       options[:headers] = @headers.merge(options[:headers])
-      Request.new(@connection, method, @path_prefix + path, options).request
+      Request.new(@connection, method, @path_prefix + validate_path(path), options).request
     end
 
     # inspect the API Service
@@ -61,6 +61,39 @@ module GoCardlessPro
 
     private
 
+    # Check that a request path cannot move the request off the configured API URL.
+    #
+    # `path` is documented as a URL without the base domain, but Faraday resolves it against
+    # the connection's prefix the way a browser resolves a link: an absolute URL
+    # ('https://host/x') or a scheme-relative one ('//host/x') replaces the configured origin
+    # outright, while the Authorization header is still attached. A caller that passes
+    # untrusted input as `path` would therefore hand the token to a host of someone else's
+    # choosing, so anything that is not a relative reference is rejected before it is joined.
+    #
+    # Parsing with URI.parse is what Faraday's own merge does, so a value cannot be read as
+    # relative here and as absolute there. URI.parse is strict and raises on values a looser
+    # parser might read as a host, so a parse failure is rejected for the same reason.
+    #
+    # Dot segments are left alone: they resolve against the base URL and so cannot leave the
+    # configured origin, which is the property this guards.
+    #
+    # @param path [String] the path to validate
+    def validate_path(path)
+      parsed = begin
+        URI.parse(path.to_s)
+      rescue URI::InvalidURIError
+        raise ArgumentError, "Invalid request path #{path.inspect}: not a valid URL path"
+      end
+
+      unless parsed.scheme.nil? && parsed.host.nil?
+        raise ArgumentError, "Invalid request path #{path.inspect}: a path may not specify " \
+                             'a scheme or a host, only a location relative to the configured ' \
+                             'API URL'
+      end
+
+      path
+    end
+
     def unpack_url(url)
       path = URI.parse(url).path
       [URI.join(url).to_s, path == '/' ? '' : path]

data/lib/gocardless_pro/client.rb

@@ -283,7 +283,7 @@ module GoCardlessPro
           'User-Agent' => "#{user_agent}",
           'Content-Type' => 'application/json',
           'GoCardless-Client-Library' => 'gocardless-pro-ruby',
-          'GoCardless-Client-Version' => '4.16.0',
+          'GoCardless-Client-Version' => '4.17.0',
         },
       }
     end

data/lib/gocardless_pro/services/base_service.rb

@@ -26,13 +26,40 @@ module GoCardlessPro
         raise NotImplementedError
       end
 
+      FORBIDDEN_URL_PARAM_CHARACTERS = %r{[/?\#\x00-\x1f\x7f]}.freeze
+
       # take a URL with placeholder params and substitute them out for the actual value
       # @param url [String] the URL with placeholders in
       # @param param_map [Hash] a hash of placeholders and their actual values (which will be escaped)
       def sub_url(url, param_map)
         param_map.reduce(url) do |new_url, (param, value)|
-          new_url.gsub(":#{param}", CGI.escape(value))
+          new_url.gsub(":#{param}", escape_url_param(param, value))
+        end
+      end
+
+      # Escape a value before it is interpolated into a request path. A URL parameter is a
+      # single path segment, so values that could move the request to a different endpoint -
+      # path separators, control characters, '.', '..' (escaping can't make these safe - a
+      # resolver strips them regardless), and empty values - are rejected instead.
+      #
+      # @param param [String] the name of the URL parameter, used for error messages
+      # @param value [String] the value to escape
+      def escape_url_param(param, value)
+        value = value.to_s
+
+        raise ArgumentError, "No value provided for URL parameter '#{param}'" if value.empty?
+
+        if ['.', '..'].include?(value)
+          raise ArgumentError, "Invalid value for URL parameter '#{param}': '#{value}' " \
+                               'would change which endpoint the request is sent to'
         end
+
+        if FORBIDDEN_URL_PARAM_CHARACTERS.match?(value)
+          raise ArgumentError, "Invalid value for URL parameter '#{param}': '#{value}' " \
+                               'contains a character that is not allowed in a path segment'
+        end
+
+        CGI.escape(value)
       end
     end
   end

data/lib/gocardless_pro/version.rb

@@ -3,5 +3,5 @@ end
 
 module GoCardlessPro
   # Current version of the GC gem
-  VERSION = '4.16.0'
+  VERSION = '4.17.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gocardless_pro
 version: !ruby/object:Gem::Version
-  version: 4.16.0
+  version: 4.17.0
 platform: ruby
 authors:
 - GoCardless