http-cookie 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 633adcbc5625bcf9d8c1509b9480d955f3107a06
-  data.tar.gz: 17c8fefbe45bb8429d3c533a1338bf4cec02345e
+  metadata.gz: d1a93009a55673a4827d9f8d85c19b5c08f4b19c
+  data.tar.gz: a7f4a3bb7a58ded55e6edac658cb20e0ad5d0821
 SHA512:
-  metadata.gz: 190e3fc5a0a658b73a9fc6c0e43937b6fd9fdebb9b6d92e09edd51c24209fbd2fb61e9ea49eb29621f2fefeb1ec5095779deded65c343f2f0c52c4f53c1e0b76
-  data.tar.gz: 96627fd5e6617b71c0b5dadf08e918169aabeda0c9ebf0f3a3d1d3d4c920b3999637f61009f4d531ddb588178bd6f0e26529b9ee49bf1808374971b7337a69f3
+  metadata.gz: d46e2e2d42e8a5e7947ccb2b0eb187b930e1e1dcb5912b75ffd78aca7532af0b9144d0210b7ca46ec3c4d591cfd8c742b64e393c60fda814d7ce75ae2aaada26
+  data.tar.gz: 5debdf55ddc8886db1e4e117e13829f6f93e2f08364126c0c693ed4dfde469374c49a35bef3f5b18455ab5379bf1289b386f30ebbae25603b4c5725beb2c231e

data/.travis.yml

@@ -1,17 +1,21 @@
+sudo: false
 language: ruby
+cache: bundler
 rvm:
   - 1.8.7
   - ree
   - 1.9.3
   - 2.0.0
+  - 2.1
+  - 2.2
+  - 2.3.0
   - ruby-head
-  - jruby-18mode
-  - jruby-19mode
-  - jruby-head
-  - rbx-18mode
-  - rbx-19mode
+  - jruby-1.7
+  - jruby-9
+  - rbx-2
 matrix:
   allow_failures:
     - rvm: ruby-head
-    - rvm: rbx-18mode
-    - rvm: rbx-19mode
+    - rvm: rbx-2
+before_install:
+  - gem update bundler

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 1.0.3 (2016-09-30)
+
+- Treat comma as normal character in HTTP::Cookie.cookie_value_to_hash
+  instead of key-value pair separator.  This should fix the problem
+  described in CVE-2016-7401.
+
 ## 1.0.2 (2013-09-10)
 
   - Fix HTTP::Cookie.parse so that it does not raise ArgumentError

data/http-cookie.gemspec

@@ -27,8 +27,8 @@ Gem::Specification.new do |gem|
   gem.add_runtime_dependency("domain_name", ["~> 0.5"])
   gem.add_development_dependency("sqlite3", ["~> 1.3.3"]) unless defined?(JRUBY_VERSION)
   gem.add_development_dependency("bundler", [">= 1.2.0"])
-  gem.add_development_dependency("test-unit", [">= 2.4.3"])
-  gem.add_development_dependency("rake", [">= 0.9.2.2"])
+  gem.add_development_dependency("test-unit", [">= 2.4.3", *("< 3" if RUBY_VERSION < "1.9")])
+  gem.add_development_dependency("rake", [">= 0.9.2.2", *("< 11" if RUBY_VERSION < "1.9")])
   gem.add_development_dependency("rdoc", ["> 2.4.2"])
   gem.add_development_dependency("simplecov", [">= 0"])
 end

data/lib/http/cookie/scanner.rb

@@ -50,7 +50,7 @@ class HTTP::Cookie::Scanner < StringScanner
     }
   end
 
-  def scan_value
+  def scan_value(comma_as_separator = false)
     ''.tap { |s|
       case
       when scan(/[^,;"]+/)
@@ -59,7 +59,9 @@ class HTTP::Cookie::Scanner < StringScanner
         # RFC 6265 2.2
         # A cookie-value may be DQUOTE'd.
         s << scan_dquoted
-      when check(/;|#{RE_COOKIE_COMMA}/o)
+      when check(/;/)
+        break
+      when comma_as_separator && check(RE_COOKIE_COMMA)
         break
       else
         s << getch
@@ -68,12 +70,12 @@ class HTTP::Cookie::Scanner < StringScanner
     }
   end
 
-  def scan_name_value
+  def scan_name_value(comma_as_separator = false)
     name = scan_name
     if skip(/\=/)
-      value = scan_value
+      value = scan_value(comma_as_separator)
     else
-      scan_value
+      scan_value(comma_as_separator)
       value = nil
     end
     [name, value]
@@ -159,7 +161,7 @@ class HTTP::Cookie::Scanner < StringScanner
 
       skip_wsp
 
-      name, value = scan_name_value
+      name, value = scan_name_value(true)
       if value.nil?
         @logger.warn("Cookie definition lacks a name-value pair.") if @logger
       elsif name.empty?
@@ -176,7 +178,7 @@ class HTTP::Cookie::Scanner < StringScanner
         break
       when skip(/;/)
         skip_wsp
-        aname, avalue = scan_name_value
+        aname, avalue = scan_name_value(true)
         next if aname.empty? || value.nil?
         aname.downcase!
         case aname
@@ -218,13 +220,12 @@ class HTTP::Cookie::Scanner < StringScanner
     until eos?
       skip_wsp
 
-      name, value = scan_name_value
+      # Do not treat comma in a Cookie header value as separator; see CVE-2016-7401
+      name, value = scan_name_value(false)
 
       yield name, value if value
 
-      # The comma is used as separator for concatenating multiple
-      # values of a header.
-      skip(/[;,]/)
+      skip(/;/)
     end
   end
 end

data/lib/http/cookie/version.rb

@@ -1,5 +1,5 @@
 module HTTP
   class Cookie
-    VERSION = "1.0.2"
+    VERSION = "1.0.3"
   end
 end

data/test/test_http_cookie.rb

@@ -441,17 +441,28 @@ class TestHTTPCookie < Test::Unit::TestCase
       ['Bar', 'value 2'],
       ['Baz', 'value3'],
       ['Bar', 'value"4'],
+      ['Quux', 'x, value=5'],
     ]
 
     cookie_value = HTTP::Cookie.cookie_value(pairs.map { |name, value|
         HTTP::Cookie.new(:name => name, :value => value)
       })
 
-    assert_equal 'Foo=value1; Bar="value 2"; Baz=value3; Bar="value\\"4"', cookie_value
+    assert_equal 'Foo=value1; Bar="value 2"; Baz=value3; Bar="value\\"4"; Quux="x, value=5"', cookie_value
 
     hash = HTTP::Cookie.cookie_value_to_hash(cookie_value)
 
-    assert_equal 3, hash.size
+    assert_equal pairs.map(&:first).uniq.size, hash.size
+
+    hash.each_pair { |name, value|
+      _, pvalue = pairs.assoc(name)
+      assert_equal pvalue, value
+    }
+
+    # Do not treat comma in a Cookie header value as separator; see CVE-2016-7401
+    hash = HTTP::Cookie.cookie_value_to_hash('Quux=x, value=5; Foo=value1; Bar="value 2"; Baz=value3; Bar="value\\"4"')
+
+    assert_equal pairs.map(&:first).uniq.size, hash.size
 
     hash.each_pair { |name, value|
       _, pvalue = pairs.assoc(name)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http-cookie
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Akinori MUSHA
@@ -11,104 +11,104 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-09-10 00:00:00.000000000 Z
+date: 2016-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: domain_name
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '0.5'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.3
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.0
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 2.4.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 2.4.3
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.9.2.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 0.9.2.2
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>'
+    - - ">"
       - !ruby/object:Gem::Version
         version: 2.4.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>'
+    - - ">"
       - !ruby/object:Gem::Version
         version: 2.4.2
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: HTTP::Cookie is a Ruby library to handle HTTP Cookies based on RFC 6265.  It
@@ -127,8 +127,8 @@ extra_rdoc_files:
 - README.md
 - LICENSE.txt
 files:
-- .gitignore
-- .travis.yml
+- ".gitignore"
+- ".travis.yml"
 - CHANGELOG.md
 - Gemfile
 - LICENSE.txt
@@ -162,17 +162,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.3
+rubygems_version: 2.6.6
 signing_key: 
 specification_version: 4
 summary: A Ruby library to handle HTTP Cookies based on RFC 6265