net-ssh 8.0.3 → 8.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db558d490e7fb5d8ca959a00ddd5a07d6c24bdc3957a8dcbb067848466928072
-  data.tar.gz: 91a1983ea97a6c94cd542c8dd55cbc0c46f99f2926d7fd168f027a90a404b693
+  metadata.gz: 110d479784d8cc56b52a5a3e9b14e5f23dbf556873b64a8e1563df31b1205911
+  data.tar.gz: e0f0d31f6476b896ddc6354906cc1b861f99687365a0783527b738e69f4d4e15
 SHA512:
-  metadata.gz: e154b5ec3ae2c1ac272e638ba3e7e51715f738ccb926a7dc2cf73ffea3819a6a39a1f08cd5b92ff6b403bd43383c400ff2b6817000f566240baedb2384419c70
-  data.tar.gz: 064a69e61d1bc28b22116fd6c26efd3339404527aa6e3a796ddca85b8eaee4aeb8d9b76c2a80f3bad0c1289436f35aaad403cb55dee2d74cd3d104764a0af0bb
+  metadata.gz: 985c71acd2df6c9e5a287c8e64c6e960cd80bd47c5d18837e1381a7c38f09ee2bbad51e3946f8d26d5f467c4999fca322e3ce4b48aa16115c2d434f675cf52cd
+  data.tar.gz: 81a1286e7e73a6c6b17a4a64e5c5004844a734bfa0118d39041ff291eb0e364c9fa4d3777cd7c745fb0ba038bd1aed2cef191b9c001cfb47937b7154a0506813

data/CHANGES.txt

@@ -1,3 +1,7 @@
+=== 8.0.4
+
+  * Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as `evil/x&$(cmd)` ran `cmd` through the shell [GHSA-g2r2-x3p2-5677]
+
 === 8.0.3
 
   * Add `preopen_channels` option: keep a spare session channel open so each command saves a round trip [#1071]

data/lib/net/ssh/proxy/jump.rb

@@ -54,20 +54,21 @@ module Net
         # We cannot build the ProxyCommand template until we know if the :config
         # option was specified during `Net::SSH.start`.
         def build_proxy_command_equivalent(connection_options = nil)
-          extra_jumps = jump_proxies.split(",", 2)[1]
+          raise ArgumentError, "no jump host given" if jump_proxies.empty?
+
           config = connection_options && connection_options[:config]
-          uri, = jump_proxies.split(",").map { |jump| validate_jump!(jump) }
+          uri, *extra_jumps = jump_proxies.split(",", -1).map { |jump| validate_jump!(jump) }
 
           template = "ssh".dup
-          template << " -l #{uri.user}"    if uri.user
-          template << " -p #{uri.port}"    if uri.port
-          template << " -J #{extra_jumps}" if extra_jumps
+          template << " -l #{escape(uri.user)}" if uri.user
+          template << " -p #{uri.port}" if uri.port
+          template << " -J #{escape(extra_jumps.map { |jump| jump_spec(jump) }.join(','))}" unless extra_jumps.empty?
           template << " -F #{escape(config)}" if config != true && config
           @options.each do |key, values|
             Array(values).each { |value| template << " -o #{escape(key)}=#{escape(value)}" }
           end
           template << " -W %h:%p "
-          template << uri.host
+          template << escape(uri.host)
 
           @command_line_template = template
         end
@@ -90,11 +91,25 @@ module Net
           Shellwords.escape(value).gsub("%", "%%")
         end
 
+        # Only [user@]host[:port] is checked, so anything else URI accepts (a path,
+        # query, fragment or password) must be refused before it reaches the shell.
         def validate_jump!(jump)
           uri = URI.parse("ssh://#{jump}")
+          raise URI::InvalidURIError if uri.host.to_s.empty? || jump_spec(uri) != jump
+
           validate_user_name!(uri.user) if uri.user
           validate_host_name!(uri.host)
+          validate_port!(uri.port) if uri.port
           uri
+        rescue URI::InvalidURIError
+          raise ArgumentError, "jump host is not [user@]host[:port]: #{jump.inspect}"
+        end
+
+        def jump_spec(uri)
+          spec = uri.host.dup
+          spec.prepend("#{uri.user}@") if uri.user
+          spec << ":#{uri.port}" if uri.port
+          spec
         end
       end
     end

data/lib/net/ssh/version.rb

@@ -52,7 +52,7 @@ module Net
       MINOR = 0
 
       # The tiny component of this version of the Net::SSH library
-      TINY  = 3
+      TINY  = 4
 
       # The prerelease component of this version of the Net::SSH library
       # nil allowed

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: net-ssh
 version: !ruby/object:Gem::Version
-  version: 8.0.3
+  version: 8.0.4
 platform: ruby
 authors:
 - Jamis Buck