net-ssh 7.2.3 → 7.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 524dafc8f2460b2e19662e19cb1916dc6b7f57b78b9cdc6ceadf486bc4fc1945
-  data.tar.gz: 1f400ebf2e8622ab81b348c6db7d45d88dfd3c3bd04e61bc60ea8678482f5f11
+  metadata.gz: a32034e7f363bc87196ff8a13b8c79bd7e9b246e98375c8e8d505cd52ea0b19a
+  data.tar.gz: d98d516fa2ddc9a8e2718e60ea4367da99ae49b5082ec0b4897db24cc86a625f
 SHA512:
-  metadata.gz: 00c33f37023f2cb493b231ee924db6be810fb8d3505d085160c6d790bcd928856081321b5743c2829e773ba506fee8aa3e5a5e9c94ec705199fa77458ad8c17f
-  data.tar.gz: 195425e6e604b3dbe56cfabd2567b292cd40caa8affbd3f624901a2ddbcb024bacc052093722407a62070bfd3bacdce4c60aee6693a29ac20ad140ba2683fcc3
+  metadata.gz: d5d09d26af82a639bb793453e27f95b89cb1dbcc15a2bd22ccad8bc7e7106d848008927dbee29b5a8f7c280a15a5bd9eced464c45f004f0c1b64ee2bb1bb8eee
+  data.tar.gz: 5b97d998e035e0c3a499ae89168f10b7e484cbf87ef551d16a11ddef1cf9d1f729b26a204d9cdabb7e1ea7b99de0e4322d9e71cba384c3d47ac0db85ccc2b8ac

data/.dockerignore

@@ -2,5 +2,8 @@
 .git/
 .gitignore
 
+# Vagrant
+test/integration/.vagrant
+
 docker-compose.yml
 README.md

data/.github/workflows/ci-with-docker.yml

@@ -12,22 +12,22 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Build docker images
-      run: docker-compose build
+      run: docker compose build
 
     - name: Run ruby 2.6
-      run: docker-compose run ruby-2.6
+      run: docker compose run ruby-2.6
 
     - name: Run ruby 2.7
-      run: docker-compose run ruby-2.7
+      run: docker compose run ruby-2.7
 
     - name: Run ruby 3.0
-      run: docker-compose run ruby-3.0
+      run: docker compose run ruby-3.0
 
     - name: Run ruby 3.1
-      run: docker-compose run ruby-3.1
+      run: docker compose run ruby-3.1
 
   test_openssl3:
     name: Run test suite with docker and openssl 3.0
@@ -35,10 +35,24 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Build docker images
       run: docker build -t netssh_openssl3 -f Dockerfile.openssl3 .
 
     - name: Run ruby 3.0 with openssl3
       run: docker run --rm netssh_openssl3
+
+  test_zlib_ng:
+    name: Run test suite with docker and zlib-ng
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Build docker images
+      run: docker build -t netssh_zlib_ng -f Dockerfile.zlib_ng .
+
+    - name: Run ruby with zlib-ng
+      run: docker run --rm netssh_zlib_ng

data/.github/workflows/ci.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3.0]
+        ruby-version: [2.6.10, 2.7.7, 3.0.6, 3.1.3, 3.2.1, 3.3, 3.4, '4.0']
     steps:
       - uses: actions/checkout@v3
 
@@ -21,16 +21,16 @@ jobs:
           python-version: 3.8
 
       - name: Cache bundler
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         id: bundler-cache
         with:
           path: vendor/bundle
           key: ${{ runner.os }}-${{ matrix.ruby-version }}-gem-v3-${{ hashFiles('**/Gemfile') }}-${{ hashFiles('**/net-ssh.gemspec') }}
           restore-keys: |
             ${{ runner.os }}-${{ matrix.ruby-version }}-gem-v3-
-      
+
       - name: Cache pip
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         id: pip-cache
         with:
           path: ~/.cache/pip
@@ -42,12 +42,12 @@ jobs:
           gem install bundler ${{ (startsWith(matrix.ruby-version, '2.6.') || startsWith(matrix.ruby-version, '2.7.')) && '-v 2.4.22' || '' }}
           bundle config set path 'vendor/bundle'
           bundle config set --local path 'vendor/bundle'
-          bundle install --jobs 4 --retry 3 --path vendor/bundle
-          BUNDLE_GEMFILE=./Gemfile.noed25519 bundle install --jobs 4 --retry 3 --path vendor/bundle
+          bundle install --jobs 4 --retry 3
+          BUNDLE_GEMFILE=./Gemfile.noed25519 bundle install --jobs 4 --retry 3
         env:
           BUNDLE_PATH: vendor/bundle
 
-      
+
       - name: Add to etc/hosts
         run: |
           sudo echo "127.0.0.1  gateway.netssh" | sudo tee -a /etc/hosts
@@ -78,17 +78,22 @@ jobs:
         env:
           NET_SSH_RUN_INTEGRATION_TESTS: 1
           CI: 1
+          RUBYOPT: '--enable=frozen-string-literal'
       - name: Run tests (without rbnacl)
         run: bundle exec rake test
         env:
           BUNDLE_GEMFILE: ./Gemfile.norbnacl
           NET_SSH_RUN_INTEGRATION_TESTS: 1
           CI: 1
+          RUBYOPT: '--enable=frozen-string-literal'
       - name: Run Tests (without ed25519)
         run: bundle exec rake test
         env:
           BUNDLE_GEMFILE: ./Gemfile.noed25519
           NET_SSH_RUN_INTEGRATION_TESTS: 1
           CI: 1
+          RUBYOPT: '--enable=frozen-string-literal'
       - name: Run test helper test
         run: bundle exec rake test_test
+        env:
+          RUBYOPT: '--enable=frozen-string-literal'

data/.rubocop_todo.yml

@@ -235,7 +235,7 @@ Lint/UselessTimes:
 # Offense count: 205
 # Configuration parameters: IgnoredMethods, CountRepeatedAttributes.
 Metrics/AbcSize:
-  Max: 74
+  Max: 76
 
 # Offense count: 16
 # Configuration parameters: CountComments, CountAsOne, ExcludedMethods, IgnoredMethods.
@@ -758,10 +758,12 @@ Style/OpenStructUse:
   Exclude:
     - 'test/authentication/test_ed25519.rb'
     - 'test/common.rb'
+    - 'test/test_known_hosts.rb'
     - 'test/transport/kex/test_curve25519_sha256.rb'
     - 'test/transport/kex/test_diffie_hellman_group1_sha1.rb'
     - 'test/transport/kex/test_ecdh_sha2_nistp256.rb'
     - 'test/verifiers/test_always.rb'
+    - 'test/verifiers/test_cert_authority_checks.rb'
 
 # Offense count: 16
 # Configuration parameters: AllowedMethods.

data/CHANGES.txt

@@ -1,3 +1,50 @@
+=== 7.3.8
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
+=== 7.3.7
+
+  * Fixed `unexpected packet type 94 during initial key exchange` (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with `rekey_limit`, or after about 1 GB); a regression in 7.3.5 [#1063]
+
+=== 7.3.6
+
+  * Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts since 7.3.4 [#1026, #1028]
+
+=== 7.3.5
+
+  * Security: refuse agent channels opened by the server unless agent forwarding was requested (`forward_agent`, ForwardAgent, or `Forward#agent`); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
+  * Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
+  * Security: reject OpenSSH private keys claiming more than 2**20 bcrypt rounds, and only run the KDF once a passphrase is given [GHSA-rpq3-v334-f5pm]
+  * Security: bound the server's identification banner like OpenSSH (8192-byte lines, 1024 lines), and apply `:timeout` to the whole version exchange instead of only its first byte [GHSA-r75w-7fhp-84w8]
+  * Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
+  * Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]
+
+=== 7.3.4
+
+  * Verify @cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host [#1010]
+
+=== 7.3.3
+
+  * Support .pub file as IdentityFile to filter/prioritize agent keys (1Password SSH agent use case) [#942]
+  * Fix cert signing regression when using a .pub companion file without an agent [#1006]
+  * Fix unreadable .pub IdentityFile silently skipped instead of raising [#1006]
+  * Allow multiple UserKnownHostsFile entries (space-separated, matching ssh_config(5)) [#979]
+  * Stop mutating ENV['HOME'] at require time [#997]
+  * Fix ED25519 loader with frozen string literals [#995]
+
+=== 7.3.2 rc2
+
+ * Fix Ruby 2.6 compat: use public_to_der fallback for EC public keys [#993]
+ * Fix test framework hang: preserve StringIO position in idle!
+
+=== 7.3.2 rc1
+
+ * Support frozen strings [#958]
+
+=== 7.3.0 rc0
+
+ * aes(128|256)gcm [#946]
+
 === 7.2.2
 
   * ruby 3.3.0: base64 fix

data/Dockerfile

@@ -3,6 +3,9 @@ FROM ruby:${RUBY_VERSION}
 
 ARG BUNDLERV=
 
+# Ruby 2.6 to 3.0 images are built on Debian bullseye, which only archive.debian.org still serves.
+RUN if grep -q bullseye /etc/os-release; then sed -i 's|deb.debian.org|archive.debian.org|; s|security.debian.org|archive.debian.org|' /etc/apt/sources.list; fi
+
 RUN apt update && apt install -y openssh-server sudo netcat-openbsd \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_1' \
   && useradd --create-home --shell '/bin/bash' --comment 'NetSSH' 'net_ssh_2' \

data/Dockerfile.zlib_ng

@@ -0,0 +1,29 @@
+FROM fedora:latest
+
+ENV INSTALL_PATH="/netssh"
+
+# Fedora's OpenSSL 3.x blocks SHA-1 for RSA/DSA signing by default.
+# - LEGACY crypto policy relaxes the system-wide restrictions.
+# - OPENSSL_CONF points to our config which activates the legacy provider,
+#   sets SECLEVEL=0, and sets rh-allow-sha1-signatures=yes (Fedora/RHEL
+#   OpenSSL patch that gates SHA-1 signing independently of the policy level).
+# OPENSSL_CONF must be set as a Docker ENV so it is in the environment before
+# Ruby/OpenSSL initialises — setting it in the Rakefile is too late.
+ENV OPENSSL_CONF="/netssh/test/openssl3.conf"
+
+RUN dnf install -y openssl ruby ruby-devel git make gcc redhat-rpm-config zlib-ng crypto-policies-scripts && \
+    update-crypto-policies --set LEGACY
+
+WORKDIR $INSTALL_PATH
+
+COPY Gemfile net-ssh.gemspec $INSTALL_PATH/
+
+COPY lib/net/ssh/version.rb $INSTALL_PATH/lib/net/ssh/version.rb
+
+RUN ls -l && gem install bundler && bundle install
+
+COPY . $INSTALL_PATH/
+
+CMD openssl version && ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION' && \
+  rpm -q zlib-ng && ruby -rzlib -e 'puts Zlib.zlib_version' && \
+  rake test

data/README.md

@@ -274,6 +274,9 @@ Support this project by becoming a sponsor. Your logo will show up here with a l
 
 [![Sponsor](https://opencollective.com/net-ssh/sponsor/0/avatar.svg)](https://opencollective.com/net-ssh/sponsor/0/website)
 
+[<img src="https://github.com/net-ssh/net-ssh/assets/52435/9690bf3e-34ea-4c52-8aea-1cc4cb5bcb6d" width="320">](https://ubicloud.com)
+
+
 ## LICENSE:
 
 (The MIT License)

data/Rakefile

@@ -9,7 +9,13 @@ require "rake"
 require "rake/clean"
 require "bundler/gem_tasks"
 
-require "rdoc/task"
+# rdoc is no longer a default gem as of Ruby 4.0; keep the rest of the
+# Rakefile usable when it is not installed.
+begin
+  require "rdoc/task"
+rescue LoadError
+  # rdoc tasks are optional
+end
 
 desc "When releasing make sure NET_SSH_BUILDGEM_SIGNED is set"
 task :check_NET_SSH_BUILDGEM_SIGNED do
@@ -27,17 +33,19 @@ require_relative "lib/net/ssh/version"
 version = Net::SSH::Version::CURRENT
 
 extra_files = %w[LICENSE.txt THANKS.txt CHANGES.txt]
-RDoc::Task.new do |rdoc|
-  rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "#{name} #{version}"
-  rdoc.generator = 'hanna' # gem install hanna-nouveau
-  rdoc.main = 'README.md'
-  rdoc.rdoc_files.include("README*")
-  rdoc.rdoc_files.include("bin/*.rb")
-  rdoc.rdoc_files.include("lib/**/*.rb")
-  extra_files.each { |file|
-    rdoc.rdoc_files.include(file) if File.exist?(file)
-  }
+if defined?(RDoc::Task)
+  RDoc::Task.new do |rdoc|
+    rdoc.rdoc_dir = "rdoc"
+    rdoc.title = "#{name} #{version}"
+    rdoc.generator = 'hanna' # gem install hanna-nouveau
+    rdoc.main = 'README.md'
+    rdoc.rdoc_files.include("README*")
+    rdoc.rdoc_files.include("bin/*.rb")
+    rdoc.rdoc_files.include("lib/**/*.rb")
+    extra_files.each { |file|
+      rdoc.rdoc_files.include(file) if File.exist?(file)
+    }
+  end
 end
 
 namespace :cert do

data/docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3'
-
 services:
   ruby-3.1:
     build:

data/lib/net/ssh/authentication/ed25519.rb

@@ -27,6 +27,9 @@ module Net
           MEND = "-----END OPENSSH PRIVATE KEY-----"
           MAGIC = "openssh-key-v1"
 
+          # Same limit as OpenSSH; bcrypt_pbkdf with 2**32 rounds would run for months (GHSA-rpq3-v334-f5pm).
+          MAX_KDF_ROUNDS = 1 << 20
+
           class DecryptError < ArgumentError
             def initialize(message, encrypted_key: false)
               super(message)
@@ -38,6 +41,11 @@ module Net
             end
           end
 
+          def self.check_bcrypt_kdf!(rounds, password)
+            raise ArgumentError.new("Private key bcrypt rounds #{rounds} exceeds #{MAX_KDF_ROUNDS}") if rounds > MAX_KDF_ROUNDS
+            raise DecryptError.new("Passphrase required for encrypted private key", encrypted_key: true) if password.nil? || password.empty?
+          end
+
           def self.read(datafull, password)
             datafull = datafull.strip
             raise ArgumentError.new("Expected #{MBEGIN} at start of private key") unless datafull.start_with?(MBEGIN)
@@ -74,6 +82,8 @@ module Net
 
               raise "BCryptPbkdf is not implemented for jruby" if RUBY_PLATFORM == "java"
 
+              check_bcrypt_kdf!(rounds, password)
+
               key = BCryptPbkdf::key(password, salt, keylen + ivlen, rounds)
               raise DecryptError.new("BCyryptPbkdf failed", encrypted_key: true) unless key
             else

data/lib/net/ssh/authentication/ed25519_loader.rb

@@ -14,13 +14,13 @@ module Net
         end
 
         def self.raiseUnlessLoaded(message)
-          description = ERROR.is_a?(LoadError) ? dependenciesRequiredForED25519 : ''
+          description = ERROR.is_a?(LoadError) ? dependenciesRequiredForED25519 : +''
           description << "#{ERROR.class} : \"#{ERROR.message}\"\n" if ERROR
           raise NotImplementedError, "#{message}\n#{description}" unless LOADED
         end
 
         def self.dependenciesRequiredForED25519
-          result = "net-ssh requires the following gems for ed25519 support:\n"
+          result = +"net-ssh requires the following gems for ed25519 support:\n"
           result << " * ed25519 (>= 1.2, < 2.0)\n"
           result << " * bcrypt_pbkdf (>= 1.0, < 2.0)\n" unless RUBY_PLATFORM == "java"
           result << "See https://github.com/net-ssh/net-ssh/issues/565 for more information\n"

data/lib/net/ssh/authentication/key_manager.rb

@@ -72,12 +72,16 @@ module Net
         def add(key_file)
           key_files.push(File.expand_path(key_file)).uniq!
           self
+        rescue ArgumentError
+          self
         end
 
         # Add the given keycert_file to the list of keycert files that will be used.
         def add_keycert(keycert_file)
           keycert_files.push(File.expand_path(keycert_file)).uniq!
           self
+        rescue ArgumentError
+          self
         end
 
         # Add the given keycert_data to the list of keycerts that will be used.
@@ -172,7 +176,11 @@ module Net
         def sign(identity, data, sig_alg = nil)
           info = known_identities[identity] or raise KeyManagerError, "the given identity is unknown to the key manager"
 
-          if info[:key].nil? && info[:from] == :file
+          if info[:from] == :pubkey_file_only
+            raise KeyManagerError, "the given identity is a public key only and cannot be used for signing without an agent"
+          end
+
+          if info[:key].nil? && (info[:from] == :file || info[:from] == :pubkey_file)
             begin
               info[:key] = KeyFactory.load_private_key(info[:file], options[:passphrase], !options[:non_interactive], options[:password_prompt])
             rescue OpenSSL::OpenSSLError, Exception => e
@@ -248,10 +256,14 @@ module Net
         def prepare_identities_from_files
           key_files.map do |file|
             if readable_file?(file)
-              identity = {}
+              identity = { privkey_file: file }
               cert_file = file + "-cert.pub"
               public_key_file = file + ".pub"
-              if readable_file?(cert_file)
+              if file.end_with?(".pub")
+                identity[:load_from] = :pubkey_file_only
+                identity[:pubkey_file] = file
+                identity.delete(:privkey_file)
+              elsif readable_file?(cert_file)
                 identity[:load_from] = :pubkey_file
                 identity[:pubkey_file] = cert_file
               elsif readable_file?(public_key_file)
@@ -260,7 +272,7 @@ module Net
               else
                 identity[:load_from] = :privkey_file
               end
-              identity.merge(privkey_file: file)
+              identity
             end
           end.compact
         end
@@ -282,7 +294,10 @@ module Net
             case identity[:load_from]
             when :pubkey_file
               key = KeyFactory.load_public_key(identity[:pubkey_file])
-              { public_key: key, from: :file, file: identity[:privkey_file] }
+              { public_key: key, from: :pubkey_file, file: identity[:privkey_file] }
+            when :pubkey_file_only
+              key = KeyFactory.load_public_key(identity[:pubkey_file])
+              { public_key: key, from: :pubkey_file_only, file: identity[:privkey_file] }
             when :privkey_file
               private_key = KeyFactory.load_private_key(
                 identity[:privkey_file], options[:passphrase], ask_passphrase, options[:password_prompt]
@@ -313,7 +328,7 @@ module Net
 
         def process_identity_loading_error(identity, e)
           case identity[:load_from]
-          when :pubkey_file
+          when :pubkey_file, :pubkey_file_only
             error { "could not load public key file `#{identity[:pubkey_file]}': #{e.class} (#{e.message})" }
           when :privkey_file
             error { "could not load private key file `#{identity[:privkey_file]}': #{e.class} (#{e.message})" }

data/lib/net/ssh/config.rb

@@ -229,7 +229,6 @@ module Net
           fingerprinthash: :fingerprint_hash,
           port: :port,
           user: :user,
-          userknownhostsfile: :user_known_hosts_file,
           checkhostip: :check_host_ip
         }.freeze
         def translate_config_key(hash, key, value, settings)
@@ -293,6 +292,8 @@ module Net
             hash[:set_env] = Shellwords.split(value.to_s).map { |e| e.split '=', 2 }.to_h
           when :numberofpasswordprompts
             hash[:number_of_password_prompts] = value.to_i
+          when :userknownhostsfile
+            hash[:user_known_hosts_file] = value.split(/\s+/)
           when *TRANSLATE_CONFIG_KEY_RENAME_MAP.keys
             hash[TRANSLATE_CONFIG_KEY_RENAME_MAP[key]] = value
           end

data/lib/net/ssh/key_factory.rb

@@ -55,7 +55,7 @@ module Net
           prompter = nil
           result =
             begin
-              key_type.read(data, passphrase || 'invalid')
+              key_type.read(data, passphrase)
             rescue *key_type.error_classes => e
               encrypted_key = !!key_type.encrypted_key?(data, e) if encrypted_key.nil?
               if encrypted_key && ask_passphrase
@@ -138,8 +138,9 @@ module Net
             raise Exception, "TODO: subclasses should implement"
           end
 
+          # A nil passphrase would make OpenSSL prompt on the terminal itself.
           def self.read(key_data, passphrase)
-            open_ssl_class.new(key_data, passphrase)
+            open_ssl_class.new(key_data, passphrase || 'invalid')
           end
 
           def self.encrypted_key?(key_data, error)
@@ -149,7 +150,7 @@ module Net
 
         class OpenSSLPKeyType < OpenSSLKeyTypeBase
           def self.read(key_data, passphrase)
-            open_ssl_class.read(key_data, passphrase)
+            open_ssl_class.read(key_data, passphrase || 'invalid')
           end
 
           def self.open_ssl_class

data/lib/net/ssh/known_hosts.rb

@@ -61,6 +61,37 @@ module Net
             false
           end
         end
+
+        # Returns true if the certificate lists no principals (unrestricted) or
+        # if the given hostname matches a listed principal. Host-certificate
+        # principals are shell-glob patterns, matching OpenSSH, whose
+        # sshkey_cert_check_host passes wildcard_pattern=1 so principals like
+        # "*.example.com" are matched with match_pattern rather than strcmp.
+        def matches_principal?(server_key, hostname)
+          server_key.valid_principals.empty? ||
+            server_key.valid_principals.any? { |principal| File.fnmatch(principal, hostname) }
+        end
+
+        # Returns true if the certificate's validity window covers the current time.
+        def matches_validity?(server_key)
+          return false if server_key.valid_after && server_key.valid_after > Time.now
+          return false if server_key.valid_before && server_key.valid_before < Time.now
+
+          true
+        end
+
+        # Returns true if the certificate is a host certificate. A user
+        # certificate (type :user) must never authenticate a host.
+        def matches_type?(server_key)
+          server_key.type == :host
+        end
+
+        # Returns true if every critical option in the certificate is one we can
+        # enforce. net-ssh enforces none, so any critical option is unsupported
+        # and, as OpenSSH does, must cause the certificate to be rejected.
+        def critical_options_supported?(server_key)
+          server_key.critical_options.empty?
+        end
       end
     end
 
@@ -89,6 +120,17 @@ module Net
       def empty?
         @host_keys.empty?
       end
+
+      # Returns the bare hostname, stripping port and IP portions from the
+      # comma-separated host string used internally.
+      #
+      # Examples:
+      #   "server.example.com"            => "server.example.com"
+      #   "server.example.com,1.2.3.4"    => "server.example.com"
+      #   "[server.example.com]:2222"      => "server.example.com"
+      def hostname
+        @host.split(",").first.gsub(/\[|\]:\d+/, "")
+      end
     end
 
     # Searches an OpenSSH-style known-host file for a given host, and returns all
@@ -160,6 +202,8 @@ module Net
       # file. The path is expanded file File.expand_path.
       def initialize(source)
         @source = File.expand_path(source)
+      rescue ArgumentError
+        @source = source
       end
 
       # Returns an array of all keys that are known to be associatd with the

data/lib/net/ssh/proxy/command.rb

@@ -16,6 +16,11 @@ module Net
       #     ...
       #   end
       class Command
+        # The command line is run by the shell, so like OpenSSH 9.6 (CVE-2023-51385) we refuse
+        # host and user names containing shell metacharacters rather than substituting them.
+        INVALID_HOST_NAME = /\A-|[[:space:][:cntrl:]'`"$\\;&<>|(){},]/.freeze
+        INVALID_USER_NAME = /\A-|[[:cntrl:]'`";&<>|(){}]|[[:space:]]-|\\\z/.freeze
+
         # The command line template
         attr_reader :command_line_template
 
@@ -41,13 +46,13 @@ module Net
           command_line = @command_line_template.gsub(/%(.)/) {
             case $1
             when 'h'
-              host
+              validate_host_name!(host)
             when 'p'
-              port.to_s
+              validate_port!(port)
             when 'r'
               remote_user = connection_options && connection_options[:remote_user]
               if remote_user
-                remote_user
+                validate_user_name!(remote_user)
               else
                 raise ArgumentError, "remote user name not available"
               end
@@ -117,6 +122,26 @@ module Net
           Process.kill('TERM', io.pid)
           Thread.new { io.close }
         end
+
+        private
+
+        def validate_host_name!(host)
+          raise ArgumentError, "host name contains invalid characters: #{host.inspect}" if host.to_s.match?(INVALID_HOST_NAME)
+
+          host
+        end
+
+        def validate_user_name!(user)
+          raise ArgumentError, "user name contains invalid characters: #{user.inspect}" if user.to_s.match?(INVALID_USER_NAME)
+
+          user
+        end
+
+        def validate_port!(port)
+          raise ArgumentError, "port is not a number: #{port.inspect}" unless port.to_s.match?(/\A\d+\z/)
+
+          port.to_s
+        end
       end
     end
   end