mechanize 2.14.0 → 2.14.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00134b35e4583ae30a00b320468fa362e7290bced2f030a3e02544848f58cde6
-  data.tar.gz: babed05130568f0a4c306ccaa77da706334bafbd3fe898c961af5e4faaa98c03
+  metadata.gz: 01e9dae7534053b14ad6ab963f43aaf4fd6475bae450ddbe78d2dc690ab0d541
+  data.tar.gz: ab9674181ce7e7a023b1e58f72c30cb84898358aa09294612b4aeee26cc5057e
 SHA512:
-  metadata.gz: 26e8e71a37e1811cfd108c3947d6eaac79576128e2b684e9b1e1d32ee83270f93b4c912b5fa8a324fb643b28dc423ed88ad95bad6efc904fe3af592d9d179844
-  data.tar.gz: 20ae7f34891ff7dd2284831acad91789656c6817d70577de885744d419ac447d8fac5cb6d7f2e609624835f2b506a85cbd5ba20f6881ae6d402f6b17ae460b82
+  metadata.gz: fc6571d503c3c2cbf2e22a6c9af5b75b3479bceaf008e3480e55d7a6ebaf9d5673c3cb61ec64fc29b6081e802afa6b2f5ec321d6247119bda822825a32f4248b
+  data.tar.gz: d2188a092148a8ea10865d1cf8e07a8f8a08c6c30760e191efa3a6af3a756821e95e525c116396000c063ba0ec670325900af4b5cb099c222cbfc6d71c5b26b3

data/.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
     - uses: actions/checkout@v4
     - uses: ruby/setup-ruby@v1
       with:
-        ruby-version: "3.3"
+        ruby-version: "4.0"
         bundler-cache: true
     - run: bundle exec rake rubocop
 
@@ -32,7 +32,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby-version: ["2.6", "2.7", "3.0", "3.1", "3.2", "3.3", "3.4", "head"]
+        ruby-version: ["2.6", "2.7", "3.0", "3.1", "3.2", "3.3", "3.4", "4.0"]
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v4

data/.github/workflows/upstream.yml

@@ -23,7 +23,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby-version: ["head"]
+        ruby-version: ["head", "truffleruby-head"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -44,7 +44,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ruby/setup-ruby@v1
-        with: { ruby-version: "3.4" }
+        with: { ruby-version: "4.0" }
       - run: |
           bundle add ${{matrix.name}} --git="${{matrix.git}}"
           bundle show

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Mechanize CHANGELOG
 
+## 2.14.1 / 2026-08-22
+
+### Security
+
+* Strip both `Proxy-Authorization` and `Cookie2` headers on a cross-origin redirect. [GHSA-2mwr-xjcg-37j7](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7)
+* Headers set through `Mechanize#request_headers=` now obey the same cross-origin redirect rules as per-request headers, instead of being re-applied unconditionally to every request. [GHSA-2mwr-xjcg-37j7](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7)
+* A redirect is now considered cross-origin when the scheme, the host or the port changes, per [RFC 6454](https://datatracker.ietf.org/doc/html/rfc6454). Previously only a host change discarded cookies, and an `https:` to `http:` redirect to the same host carried credentials in cleartext. [GHSA-5jgv-wc2m-xv99](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-5jgv-wc2m-xv99)
+* A `meta` refresh that points cross-origin now discards sensitive request headers, the same as an HTTP redirect. Previously headers set through `Mechanize#request_headers=` followed it unconditionally. [GHSA-c6rp-p8xm-4q9f](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f)
+
+### Improved
+
+* A `meta` refresh now carries the original request's headers, minus any credential withheld for crossing an origin and minus the entity headers of the original request. Previously it carried only the headers set through `Mechanize#request_headers=`.
+* `robots.txt` is fetched without any caller-supplied request headers, on any origin. Previously it received the headers set through `Mechanize#request_headers=`. It is a request mechanize makes on its own behalf.
+
+
 ## 2.14.0 / 2025-01-05
 
 * `Mechanize` exposes a `write_timeout` attribute, which is set on the connection if it's supported (e.g., `Net::HTTP::Persistent.write_timeout`). (#586) @maurycy

data/Gemfile

@@ -4,9 +4,9 @@ gemspec
 
 gem "minitest", "~> 5.14"
 gem "rake", "~> 13.0"
-gem "rdoc", "~> 6.3"
+gem "rdoc", "~> 7.2"
 gem "rubocop", "~> 1.12"
 unless RUBY_PLATFORM == 'java'
   gem 'brotli', '>= 0.5'
-  gem 'zstd-ruby', '~> 1.5'
+  gem 'zstd-ruby', '~> 2.0'
 end

data/README.md

@@ -56,6 +56,13 @@ bundle exec rake test
 See also Mechanize::TestCase to read about the built-in testing infrastructure.
 
 
+### Security and Vulnerability Reporting
+
+Please report vulnerabilities at https://github.com/sparklemotion/mechanize/security
+
+See [SECURITY.md](SECURITY.md) for full information and description of our security policy.
+
+
 ## Authors
 
 * Eric Hodel

data/Rakefile

@@ -31,7 +31,7 @@ end
 desc "Run tests"
 Rake::TestTask.new { |t|
   t.test_files = Dir['test/**/test*.rb']
-  t.verbose = true
+  # t.verbose = true
 }
 
 task publish_docs: %w[rdoc] do

data/SECURITY.md

@@ -0,0 +1,11 @@
+# Security and Vulnerability Reporting
+
+The Mechanize Core Contributors take security very seriously and investigate all reported vulnerabilities.
+
+If you would like to report a vulnerability or have a security concern regarding Mechanize or how Mechanize is using any of its underlying platform-specific libraries, please [report it via Github](https://github.com/sparklemotion/mechanize/security).
+
+Your report should be acknowledged within a week, and you'll receive a more detailed response within two weeks indicating next steps in handling your report.
+
+If you have not received a reply to your submission within a week, contact the current security coordinator (Mike Dalessio <mike.dalessio@gmail.com>).
+
+If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure.

data/lib/mechanize/http/agent.rb

@@ -9,10 +9,14 @@ require 'webrobots'
 
 class Mechanize::HTTP::Agent
 
-  CREDENTIAL_HEADERS = ['Authorization']
-  COOKIE_HEADERS = ['Cookie']
+  CREDENTIAL_HEADERS = ['Authorization', 'Proxy-Authorization']
+  COOKIE_HEADERS = ['Cookie', 'Cookie2']
   POST_HEADERS = ['Content-Length', 'Content-MD5', 'Content-Type']
 
+  # Symbols accepted as header names in the per-request headers hash, and the
+  # header each one names.
+  SYMBOL_HEADERS = { :etag => 'ETag', :if_modified_since => 'If-Modified-Since' }.freeze
+
   # :section: Headers
 
   # Disables If-Modified-Since conditional requests (enabled by default)
@@ -21,7 +25,9 @@ class Mechanize::HTTP::Agent
   # Is gzip compression of requests enabled?
   attr_accessor :gzip_enabled
 
-  # A hash of request headers to be used for every request
+  # A hash of request headers to be used for every request.  Headers named in
+  # CREDENTIAL_HEADERS or COOKIE_HEADERS are withheld from a request that
+  # follows a redirect across an origin; see #crosses_origin?.
   attr_accessor :request_headers
 
   # The User-Agent header to send
@@ -240,9 +246,20 @@ class Mechanize::HTTP::Agent
   #
   # +redirects+ tracks the number of redirects experienced when retrieving the
   # page.  If it is over the redirection_limit an error will be raised.
+  #
+  # +apply_request_headers+ merges #request_headers into +headers+.  It is true
+  # for a request the caller initiated and false for one continuing an
+  # operation already under way, such as following a redirect, where +headers+
+  # already carries the merged set minus anything withheld along the way.
 
   def fetch uri, method = :get, headers = {}, params = [],
-            referer = current_page, redirects = 0
+            referer = current_page, redirects = 0, apply_request_headers = true
+
+    # Fold the agent defaults into the caller's headers once, at the start of
+    # the operation, so that from here on a single hash carries every header
+    # and #response_redirect can drop a credential from it for good.  Requests
+    # continuing an operation pass false and supply the hash they were given.
+    headers = merge_request_headers headers if apply_request_headers
 
     referer_uri = referer ? referer.uri : nil
     uri         = resolve uri, referer
@@ -313,7 +330,7 @@ class Mechanize::HTTP::Agent
 
     response_cookies response, uri, page
 
-    meta = response_follow_meta_refresh response, uri, page, redirects
+    meta = response_follow_meta_refresh response, uri, page, redirects, headers
     return meta if meta
 
     if robots && page.is_a?(Mechanize::Page)
@@ -585,23 +602,58 @@ class Mechanize::HTTP::Agent
     end
   end
 
-  def request_add_headers request, headers = {}
-    @request_headers.each do |k,v|
-      request[k] = v
+  # The agent defaults, with +headers+ applied on top.  A header in +headers+
+  # replaces an agent default naming the same header, whatever the spelling,
+  # because header names are case-insensitive and the agent's keys may be
+  # symbols.
+  def merge_request_headers headers
+    merged = {}
+
+    @request_headers.each { |field, value| merged[field.to_s] = value }
+
+    headers.each do |field, value|
+      name = canonical_header_name field
+      merged.delete_if { |existing, _| canonical_header_name(existing) == name }
+      merged[field] = value
     end
 
+    merged
+  end
+
+  def canonical_header_name field
+    (SYMBOL_HEADERS[field] || field).to_s.downcase
+  end
+
+  def request_add_headers request, headers = {}
     headers.each do |field, value|
-      case field
-      when :etag              then request["ETag"] = value
-      when :if_modified_since then request["If-Modified-Since"] = value
-      when Symbol then
-        raise ArgumentError, "unknown header symbol #{field}"
+      if Symbol === field then
+        name = SYMBOL_HEADERS[field] or
+          raise ArgumentError, "unknown header symbol #{field}"
+        request[name] = value
       else
         request[field] = value
       end
     end
   end
 
+  # Does moving from +from_uri+ to +to_uri+ cross an origin?  An origin is the
+  # scheme, host and port together; see RFC 6454.
+  def crosses_origin? from_uri, to_uri
+    to_uri.scheme != from_uri.scheme ||
+      to_uri.host != from_uri.host ||
+      to_uri.port != from_uri.port
+  end
+
+  # Should the header named +name+ be withheld from a request issued after a
+  # redirect that crossed an origin?
+  def drop_after_redirect? name, crossed_origin
+    crossed_origin && match_header?(name, CREDENTIAL_HEADERS + COOKIE_HEADERS)
+  end
+
+  def match_header? name, candidates
+    candidates.any? { |candidate| name.to_s.casecmp?(candidate) }
+  end
+
   def request_auth request, uri
     base_uri = uri + '/'
     base_uri.user     &&= nil
@@ -874,7 +926,7 @@ class Mechanize::HTTP::Agent
       raise Mechanize::UnauthorizedError.new(page, challenges, message)
     end
 
-    fetch uri, request.method.downcase.to_sym, headers, params, referer
+    fetch uri, request.method.downcase.to_sym, headers, params, referer, 0, false
   end
 
   def response_content_encoding response, body_io
@@ -951,7 +1003,7 @@ class Mechanize::HTTP::Agent
     end
   end
 
-  def response_follow_meta_refresh response, uri, page, redirects
+  def response_follow_meta_refresh response, uri, page, redirects, headers = {}
     delay, new_url = get_meta_refresh(response, uri, page)
     return nil unless delay
     new_url = new_url ? secure_resolve!(new_url, page) : uri
@@ -961,8 +1013,16 @@ class Mechanize::HTTP::Agent
 
     sleep delay
     @history.push(page, page.uri)
-    fetch new_url, :get, {}, [],
-          Mechanize::Page.new, redirects + 1
+
+    headers = headers.dup
+
+    # The refresh is fetched with GET, so the original request's entity headers
+    # must not describe it.
+    POST_HEADERS.each { |key| headers.delete_if { |h, _| h.to_s.casecmp?(key) } }
+    headers.delete_if { |h, _| drop_after_redirect? h, crosses_origin?(uri, new_url) }
+
+    fetch new_url, :get, headers, [],
+          Mechanize::Page.new, redirects + 1, false
   end
 
   def response_log response
@@ -1065,18 +1125,12 @@ class Mechanize::HTTP::Agent
       headers.delete_if { |h| h.casecmp?(key) }
     end
 
-    # Make sure we clear credential headers if being redirected to another site
-    if new_uri.host == page.uri.host
-      if new_uri.port != page.uri.port
-        # https://datatracker.ietf.org/doc/html/rfc6265#section-8.5
-        # cookies are OK to be shared across ports on the same host
-        CREDENTIAL_HEADERS.each { |ch| headers.delete_if { |h| h.casecmp?(ch) } }
-      end
-    else
-      (COOKIE_HEADERS + CREDENTIAL_HEADERS).each { |ch| headers.delete_if { |h| h.casecmp?(ch) } }
-    end
+    # Sensitive headers must not follow a redirect across an origin.
+    crossed_origin = crosses_origin? page.uri, new_uri
+
+    headers.delete_if { |h, _| drop_after_redirect? h, crossed_origin }
 
-    fetch new_uri, redirect_method, headers, [], referer, redirects + 1
+    fetch new_uri, redirect_method, headers, [], referer, redirects + 1, false
   end
 
   # :section: Robots
@@ -1087,7 +1141,7 @@ class Mechanize::HTTP::Agent
     robots_mutex.synchronize do
       Thread.current[RobotsKey] = true
       begin
-        fetch(uri).body
+        fetch(uri, :get, {}, [], current_page, 0, false).body
       rescue Mechanize::ResponseCodeError => e
         case e.response_code
         when /\A4\d\d\z/

data/lib/mechanize/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 class Mechanize
-  VERSION = "2.14.0"
+  VERSION = "2.14.1"
 end

data/lib/mechanize.rb

@@ -1011,7 +1011,16 @@ Use of #auth and #basic_auth are deprecated due to a security vulnerability.
   end
 
   ##
-  # A hash of custom request headers that will be sent on every request
+  # A hash of custom request headers that will be sent on every request.
+  #
+  # Headers named in Mechanize::HTTP::Agent::CREDENTIAL_HEADERS or
+  # COOKIE_HEADERS are withheld from a request that follows a redirect to
+  # another origin, where an origin is the scheme, host and port together, and
+  # stay withheld for the rest of that operation.  A meta refresh to another
+  # origin is treated the same way.
+  #
+  # The robots.txt lookup carries none of these headers, on any origin.  It is
+  # a request mechanize makes on its own behalf.
 
   def request_headers
     @agent.request_headers
@@ -1019,7 +1028,8 @@ Use of #auth and #basic_auth are deprecated due to a security vulnerability.
 
   ##
   # Replaces the custom request headers that will be sent on every request
-  # with +request_headers+
+  # with +request_headers+.  See #request_headers for the credentials
+  # withheld after a redirect to another origin.
 
   def request_headers= request_headers
     @agent.request_headers = request_headers

data/test/htdocs/frame_test.html

@@ -18,13 +18,15 @@
   </IFRAME>
   </FRAMESET>
   <NOFRAMES>
-      <P>This frameset document contains:
-      <UL>
-         <LI><A href="/google.html">Some neat contents</A>
-         <LI><A href="/form_test.html" class="bar">Form Test</A>
-         <LI><A href="/file_upload.html">Some other neat contents</A>
-      </UL>
+    Your user agent does not support frames.
   </NOFRAMES>
+  <P>This frameset document contains:
+    <UL>
+      <LI><A href="/google.html">Some neat contents</A>
+      <LI><A href="/form_test.html" class="bar">Form Test</A>
+      <LI><A href="/file_upload.html">Some other neat contents</A>
+    </UL>
+  </P>
 </FRAMESET>
 </HTML>
 

data/test/htdocs/relative/tc_relative_links.html

@@ -2,6 +2,7 @@
   <body>
     <a href="../tc_relative_links.html">dot dot slash</a>
     <a href="../../../../../tc_relative_links.html">too many dots</a>
+    <a href="?a=b">just the query string</A>
 <FRAMESET cols="20%, 80%">
   <FRAMESET rows="100, 200, 200">
   <FRAME name="frame1" src="../tc_relative_links.html">
@@ -13,7 +14,6 @@
   [Your user agent does not support frames or is currently configured
   not to display frames. However, you may visit
   <A href="foo.html">the related document.</A>]
-  <a href="?a=b">just the query string</A>
   </IFRAME>
   </FRAMESET>
 </FRAMESET>

data/test/test_mechanize_http_agent.rb

@@ -464,12 +464,50 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     assert_equal @headers, @req.to_hash.keys.sort
   end
 
-  def test_request_add_headers_request_headers
+  def test_fetch_accepts_symbol_names_in_request_headers
+    @agent.request_headers = { Authorization: 'Bearer tokensecret' }
+
+    page = @agent.fetch 'http://example/http_headers'
+
+    assert_match 'authorization|Bearer tokensecret', page.body
+  end
+
+  def test_fetch_lets_a_request_header_override_any_spelling_of_an_agent_header
+    @agent.request_headers = { 'Authorization' => 'agent-one', 'authorization' => 'agent-two' }
+
+    page = @agent.fetch 'http://example/http_headers', :get,
+                        { 'Authorization' => 'per-request' }
+
+    assert_match 'authorization|per-request', page.body
+  end
+
+  def test_meta_refresh_drops_entity_headers
+    @agent.follow_meta_refresh = true
+
+    uri = URI 'http://example/session'
+    response = Net::HTTPOK.new '1.1', '200', 'OK'
+    response['Refresh'] = '0;url=/http_headers'
+    page = Mechanize::Page.new uri, response, '', 200, @mech
+
+    @agent.response_follow_meta_refresh(response, uri, page, 0,
+                                        { 'Content-Length' => '7',
+                                          'Content-Type' => 'text/plain',
+                                          'Content-MD5' => 'deadbeef' })
+
+    request = requests.last
+
+    assert_equal 'GET', request.method
+    assert_nil request['Content-Length']
+    assert_nil request['Content-Type']
+    assert_nil request['Content-MD5']
+  end
+
+  def test_fetch_applies_request_headers
     @agent.request_headers['X-Foo'] = 'bar'
 
-    @agent.request_add_headers @req
+    page = @agent.fetch 'http://example/http_headers'
 
-    assert_equal @headers + %w[x-foo], @req.to_hash.keys.sort
+    assert_match 'x-foo|bar', page.body
   end
 
   def test_request_add_headers_symbol
@@ -1300,6 +1338,33 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     assert_equal uri, page.uri
   end
 
+  def test_response_follow_meta_refresh_to_cross_origin_drops_agent_request_headers
+    uri = URI.parse 'http://example/'
+
+    body = <<-BODY
+<title></title>
+<meta http-equiv="refresh" content="0;url=http://trap/http_headers">
+    BODY
+
+    page = Mechanize::Page.new(uri, nil, body, 200, @mech)
+
+    @agent.follow_meta_refresh = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    page = @agent.response_follow_meta_refresh @res, uri, page, 0
+
+    refute_match("authorization|Bearer tokensecret", page.body)
+  end
+
+  def test_meta_refresh_to_same_origin_keeps_agent_request_headers
+    @agent.follow_meta_refresh = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    page = @agent.fetch 'http://example/http_refresh?refresh_url=/http_headers'
+
+    assert_match("authorization|Bearer tokensecret", page.body)
+  end
+
   def test_response_follow_meta_refresh_limit
     uri = URI.parse 'http://example/#id+1'
 
@@ -1669,6 +1734,171 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
     refute_match("cookie|name=value", page.body)
   end
 
+  def test_response_redirect_to_cross_site_strips_all_credential_headers
+    @agent.redirect_ok = true
+
+    headers = {
+      'Range' => 'bytes=0-9999',
+      'Proxy-Authorization' => 'Basic proxysecret',
+      'Cookie2' => 'version=1',
+    }
+
+    page = html_page ''
+    page = @agent.response_redirect({ 'Location' => 'http://trap/http_headers' }, :get,
+                                    page, 0, headers)
+
+    refute_includes(headers.keys, "Proxy-Authorization")
+    refute_includes(headers.keys, "Cookie2")
+
+    refute_match("proxy-authorization|Basic proxysecret", page.body)
+    refute_match("cookie2|version=1", page.body)
+  end
+
+  def test_response_redirect_to_same_site_keeps_all_credential_headers
+    @agent.redirect_ok = true
+
+    headers = {
+      'Proxy-Authorization' => 'Basic proxysecret',
+      'Cookie2' => 'version=1',
+    }
+
+    page = html_page ''
+    page = @agent.response_redirect({ 'Location' => '/http_headers' }, :get,
+                                    page, 0, headers)
+
+    assert_match("proxy-authorization|Basic proxysecret", page.body)
+    assert_match("cookie2|version=1", page.body)
+  end
+
+  def test_response_redirect_to_cross_site_drops_agent_request_headers
+    @agent.redirect_ok = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret', 'Cookie' => 'name=value' }
+
+    page = html_page ''
+    page = @agent.response_redirect({ 'Location' => 'http://trap/http_headers' }, :get,
+                                    page, 0, {})
+
+    refute_match("authorization|Bearer tokensecret", page.body)
+    refute_match("cookie|name=value", page.body)
+  end
+
+  def test_redirect_to_cross_site_keeps_insensitive_agent_request_headers
+    @agent.redirect_ok = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret', 'X-Api-Key' => 'apikey' }
+
+    page = @agent.fetch 'http://example/redirect', :get,
+                        { 'X-Location' => 'http://trap/http_headers' }
+
+    refute_match("authorization|Bearer tokensecret", page.body)
+    assert_match("x-api-key|apikey", page.body)
+  end
+
+  def test_redirect_to_same_site_keeps_agent_request_headers
+    @agent.redirect_ok = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    page = @agent.fetch 'http://example/redirect', :get, { 'X-Location' => '/http_headers' }
+
+    assert_match("authorization|Bearer tokensecret", page.body)
+  end
+
+  def test_response_redirect_to_downgraded_scheme_strips_credential
+    @agent.redirect_ok = true
+
+    headers = { 'AUTHORIZATION' => 'Basic xxx', 'cookie' => 'name=value' }
+
+    page = page 'https://example:8443/', 'text/html'
+    page = @agent.response_redirect({ 'Location' => 'http://example:8443/http_headers' }, :get,
+                                    page, 0, headers)
+
+    refute_includes(headers.keys, "AUTHORIZATION")
+    refute_includes(headers.keys, "cookie")
+
+    refute_match("authorization|Basic xxx", page.body)
+    refute_match("cookie|name=value", page.body)
+  end
+
+  def test_response_redirect_to_downgraded_scheme_drops_agent_request_headers
+    @agent.redirect_ok = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    page = page 'https://example:8443/', 'text/html'
+    page = @agent.response_redirect({ 'Location' => 'http://example:8443/http_headers' }, :get,
+                                    page, 0, {})
+
+    refute_match("authorization|Bearer tokensecret", page.body)
+  end
+
+  def test_response_redirect_to_different_port_strips_cookie
+    @agent.redirect_ok = true
+
+    headers = { 'cookie' => 'name=value' }
+
+    page = html_page ''
+    page = @agent.response_redirect({ 'Location' => 'http://example:81/http_headers' }, :get,
+                                    page, 0, headers)
+
+    refute_match("cookie|name=value", page.body)
+  end
+
+  # Every request the agent made to a host other than the one the credential
+  # was set for.
+  def foreign_requests
+    requests.reject { |request| request['host'] == 'example' }
+  end
+
+  def test_second_redirect_hop_on_a_foreign_origin_does_not_restore_credentials
+    @agent.redirect_ok = true
+    @agent.redirection_limit = 2
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    assert_raises Mechanize::RedirectLimitReachedError do
+      @agent.fetch 'http://example/redirect', :get,
+                   { 'X-Location' => 'http://trap/redirect' }
+    end
+
+    assert_operator foreign_requests.length, :>, 1
+    assert_empty foreign_requests.select { |r| r['Authorization'] }
+  end
+
+  def test_authentication_retry_on_a_foreign_origin_does_not_restore_credentials
+    @agent.redirect_ok = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+    @agent.add_auth URI('http://trap/'), 'user', 'pass'
+
+    begin
+      @agent.fetch 'http://example/redirect', :get,
+                   { 'X-Location' => 'http://trap/basic_auth' }
+    rescue Mechanize::UnauthorizedError
+      # a leaked bearer token overwrites the Basic credential and the retry fails
+    end
+
+    assert_operator foreign_requests.length, :>, 1
+    assert_empty foreign_requests.select { |r| r['Authorization'] == 'Bearer tokensecret' }
+  end
+
+  def test_meta_refresh_to_a_second_foreign_origin_does_not_restore_credentials
+    @agent.redirect_ok = true
+    @agent.follow_meta_refresh = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    @agent.fetch 'http://example/redirect', :get,
+                 { 'X-Location' => 'http://trap/http_refresh?refresh_url=/http_headers' }
+
+    assert_nil requests.find { |r| r.path == '/http_headers' }['Authorization']
+  end
+
+  def test_robots_lookup_on_a_foreign_origin_does_not_send_credentials
+    @agent.redirect_ok = true
+    @agent.robots = true
+    @agent.request_headers = { 'Authorization' => 'Bearer tokensecret' }
+
+    @agent.fetch 'http://example/redirect', :get,
+                 { 'X-Location' => 'http://trap/http_headers' }
+
+    assert_nil requests.find { |r| r.path == '/robots.txt' }['Authorization']
+  end
+
   def test_response_redirect_to_same_site_with_credential
     @agent.redirect_ok = true
 
@@ -1704,11 +1934,11 @@ class TestMechanizeHttpAgent < Mechanize::TestCase
                                     page, 0, headers)
 
     refute_includes(headers.keys, "AUTHORIZATION")
-    assert_includes(headers.keys, "cookie")
+    refute_includes(headers.keys, "cookie")
 
     assert_match("range|bytes=0-9999", page.body)
     refute_match("authorization|Basic xxx", page.body)
-    assert_match("cookie|name=value", page.body)
+    refute_match("cookie|name=value", page.body)
   end
 
   def test_response_redirect_not_ok

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mechanize
 version: !ruby/object:Gem::Version
-  version: 2.14.0
+  version: 2.14.1
 platform: ruby
 authors:
 - Eric Hodel
@@ -11,7 +11,7 @@ authors:
 - Lee Jarvis
 bindir: bin
 cert_chain: []
-date: 2025-01-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -232,10 +232,11 @@ email:
 executables: []
 extensions: []
 extra_rdoc_files:
+- CHANGELOG.md
 - EXAMPLES.rdoc
 - GUIDE.rdoc
-- CHANGELOG.md
 - README.md
+- SECURITY.md
 files:
 - ".autotest"
 - ".github/dependabot.yml"
@@ -250,6 +251,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- SECURITY.md
 - examples/flickr_upload.rb
 - examples/latest_user_agents.rb
 - examples/mech-dump.rb
@@ -474,7 +476,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 4.0.16
 specification_version: 4
 summary: The Mechanize library is used for automating interaction with websites
 test_files: