http.rb 1.3.5 → 1.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b19f251bfdf7beb262c7f6fe8c00950fb580937b1679cef33059346e4695d8a4
-  data.tar.gz: 6dd0dfa38e25d6805552778398c36df2bf8e42d6f507f23fe8bde2aeb229945c
+  metadata.gz: 198e221dc9a1ced43833cfa01886896755615ccc22d9773d0798627d0af1bd45
+  data.tar.gz: 53d2e227daa4558d0f810980e2b86ec60fa17c4222c2e61e507c164097c25071
 SHA512:
-  metadata.gz: 923a61906a76fd676e1f47808ccc3d295cc9d7c6b5b977d5ec1ff9a496daf8488dfd5f49f1169b650343d66aba9d9994cc166d9caf9d2a64a9e6440c5ac3fb64
-  data.tar.gz: 672784fee166a077e19e8b79866c24b84793c9aa82c7e4bbe217cbca60565fa0ad241c3d739bb3808108a4caa9ac2f036428943c7d1337327f35b8083ddc737b
+  metadata.gz: 2ef160053a5a5069e6be6714daf9229358ece7af8899ec0f5fcc8b98f9b5b4cb05c434d0c3a5a946f7e95a66cf55e19feb918f8096f8793b0bbc25780bd8545a
+  data.tar.gz: 0a9721b58212b93670c368496c50bc19f7ea4d53d1b860728b6a3fd5ff8b2d7f81d388cee42a6f969bd65c5ca5584d126d75e1fb5092e35372312e32593c6cd7

data/CHANGELOG

@@ -1,5 +1,17 @@
 # CHANGELOG
 
+## 20261011
+
+1.3.6: Authorization and Cookie headers go no further than the origin they were given to.
+
+A 307 or 308 was followed with every header it was given, so an Authorization or Cookie header meant for one host was sent to whichever host the Location named. A 301, 302, or 303 sent no headers on at all, so it did not leak, though only because it lost everything else too. Following curl and browsers, credentials now stay with their origin: the same scheme, host, and port.
+
+1. + lib/HTTP/REDIRECT.rb: HTTP::REDIRECT::CREDENTIAL_HEADERS (Authorization, Cookie); HTTP.same_origin?, and HTTP.redirect_headers, which drops the credential headers, whatever their case, where a redirect goes to another origin.
+2. ~ HTTP.request: a 307 or 308 is followed with redirect_headers rather than the headers as given.
+3. + test/HTTP/REDIRECT_test.rb: credentials kept for the same origin, and dropped for another host by 307 and by 308, for another scheme, and for another port, with other headers carried on. All but the first fail against 1.3.5.
+4. ~ HTTP::VERSION: /1.3.5/1.3.6/
+
+
 ## 20261011
 
 1.3.5: Non-ASCII is URL-encoded in full, and without a warning.

data/lib/HTTP/REDIRECT.rb

@@ -0,0 +1,20 @@
+# HTTP/REDIRECT.rb
+# HTTP::REDIRECT (redirect helpers)
+
+module HTTP
+  module REDIRECT
+    CREDENTIAL_HEADERS = %w{authorization cookie}.freeze
+  end
+
+  def same_origin?(a, b)
+    [a.scheme, a.host, a.port] == [b.scheme, b.host, b.port]
+  end
+  module_function :same_origin?
+
+  # Credentials are for the origin they were given to, so they go no further than it.
+  def redirect_headers(headers, from_uri, to_uri)
+    return headers if same_origin?(from_uri, to_uri)
+    headers.reject{|k, v| REDIRECT::CREDENTIAL_HEADERS.include?(k.downcase)}
+  end
+  module_function :redirect_headers
+end

data/lib/HTTP/VERSION.rb

@@ -2,5 +2,5 @@
 # HTTP::VERSION
 
 module HTTP
-  VERSION = '1.3.5'
+  VERSION = '1.3.6'
 end

data/lib/HTTP/request.rb

@@ -9,6 +9,7 @@ require_relative '../Net/HTTP/set_options'
 require_relative '../Net/HTTPRequest/set_headers'
 require_relative '../Net/HTTPResponse/StatusPredicates'
 require_relative '../URI/Generic/use_sslQ'
+require_relative './REDIRECT'
 require_relative './RETRY'
 
 module HTTP
@@ -46,7 +47,7 @@ module HTTP
       redirect_uri = uri.merge(response['location'])
       if response.code =~ /^30[78]$/
         data = METHODS::WITH_BODY.include?(request_method) ? request_object.body : {}
-        response = send(request_method, redirect_uri.to_s, data, headers, options, &block)
+        response = send(request_method, redirect_uri.to_s, data, redirect_headers(headers, uri, redirect_uri), options, &block)
       else
         response = get(redirect_uri.to_s, {}, {}, options, &block)
       end

data/test/HTTP/REDIRECT_test.rb

@@ -0,0 +1,40 @@
+# test/HTTP/REDIRECT_test.rb
+
+require_relative '../helper'
+
+describe "redirect behaviour" do
+  let(:uri){'http://example.com/path'}
+  let(:same_origin_uri){'http://example.com/elsewhere'}
+  let(:other_origin_uri){'http://redirected.com/path'}
+
+  describe "credentials" do
+    it "are kept for the same origin" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => same_origin_uri})
+      stub_request(:get, same_origin_uri).with(headers: {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).to_return(status: 200)
+      _(HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'Cookie' => 'session=1'}).success?).must_equal(true)
+    end
+
+    %w{307 308}.each do |code|
+      it "are dropped for another origin via #{code}" do
+        stub_request(:get, uri).to_return(status: code.to_i, headers: {'location' => other_origin_uri})
+        stub_request(:get, other_origin_uri).to_return(status: 200)
+        HTTP.get(uri, {}, {'Authorization' => 'Bearer x', 'cookie' => 'session=1', 'User-Agent' => 'Redback'})
+        assert_requested(:get, other_origin_uri){|request| !request.headers.key?('Authorization') && !request.headers.key?('Cookie') && request.headers['User-Agent'] == 'Redback'}
+      end
+    end
+
+    it "are dropped for another scheme" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => 'https://example.com/path'})
+      stub_request(:get, 'https://example.com/path').to_return(status: 200)
+      HTTP.get(uri, {}, {'Cookie' => 'session=1'})
+      assert_requested(:get, 'https://example.com/path'){|request| !request.headers.key?('Cookie')}
+    end
+
+    it "are dropped for another port" do
+      stub_request(:get, uri).to_return(status: 307, headers: {'location' => 'http://example.com:8080/path'})
+      stub_request(:get, 'http://example.com:8080/path').to_return(status: 200)
+      HTTP.get(uri, {}, {'Cookie' => 'session=1'})
+      assert_requested(:get, 'http://example.com:8080/path'){|request| !request.headers.key?('Cookie')}
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: http.rb
 version: !ruby/object:Gem::Version
-  version: 1.3.5
+  version: 1.3.6
 platform: ruby
 authors:
 - thoran
@@ -95,6 +95,7 @@ files:
 - http.rb.gemspec
 - lib/HTTP.rb
 - lib/HTTP/METHODS.rb
+- lib/HTTP/REDIRECT.rb
 - lib/HTTP/RETRY.rb
 - lib/HTTP/VERSION.rb
 - lib/HTTP/request.rb
@@ -108,6 +109,7 @@ files:
 - lib/Thoran/String/Urlencode/urlencode.rb
 - lib/URI/Generic/use_sslQ.rb
 - test/HTTP/METHODS_test.rb
+- test/HTTP/REDIRECT_test.rb
 - test/HTTP/RETRY_test.rb
 - test/HTTP/VERSION_test.rb
 - test/HTTP/basic_auth_test.rb