oauth2 2.0.21 → 2.0.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 052c478b34f1b8c1d2da2469c20ca121bf4bbc5013b4996463a6d66472803574
-  data.tar.gz: 649fe4671d37facfb4afe1a095332853b1a19bad4af38cfb5139bfecd4990ed2
+  metadata.gz: 7964123b20cd2a456b4207c27b2695bbe8e46b30efdafc01731bdf97038fd58e
+  data.tar.gz: 908001fb4aa70279ee6384a0de5fefb43bf3c8b64466e5df248f244b353a270c
 SHA512:
-  metadata.gz: cc899a7ec288fa4a8226a8e56305b91b89be8e3644609c517bf3c5c80df2119b2970edb96850903a953761565cf36fbe9d91e1255cac0dcc74a6d0ad6b79789c
-  data.tar.gz: 87005576b091dc223e5ce1af711a9f449581627be4a9c56ac6b270abd4aa1bec94fd006c99b95c0146890af26f216d657ad877b4df6c8b023fcb12ec318519b8
+  metadata.gz: 772d189a481bf1329bcbb0443f98ce2feefefcc77387dad7d8f6128ebd2139a29fc0c2410721394aec5bcece3f786b980c33eba6acc0fe6ecd1c4366308dc0fb
+  data.tar.gz: 959412178a6d2b37902c1b91a7e3b8c688dc1142dc118e56752ddaf0fdc99c06017d297d96ccfd0b37bca1dc2308c441050b40b64f06d31a815c6f5df7c91d0d

data/CHANGELOG.md

@@ -30,6 +30,23 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.0.22] - 2026-06-07
+
+- TAG: [v2.0.22][2.0.22t]
+- COVERAGE: 100.00% -- 542/542 lines in 15 files
+- BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
+- 88.35% documented
+
+### Changed
+
+- Raised generated development tooling floors to `kettle-dev` >= 2.1.1 and
+  `version_gem` >= 1.1.11.
+- Raised the runtime dependency floor for `snaky_hash` to `>= 2.0.5`.
+
+### Security
+
+- [GHSA-pp92-crg2-gfv9] Prevent protocol-relative redirect `Location` values from changing request authority, and strip `Authorization` headers from cross-origin redirects.
+
 ## [2.0.21] - 2026-06-06
 
 - TAG: [v2.0.21][2.0.21t]
@@ -846,7 +863,9 @@ Please file a bug if you notice a violation of semantic versioning.
 
 [gemfiles/readme]: gemfiles/README.md
 
-[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.21...HEAD
+[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.22...HEAD
+[2.0.22]: https://github.com/ruby-oauth/oauth2/compare/v2.0.21...v2.0.22
+[2.0.22t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22
 [2.0.21]: https://github.com/ruby-oauth/oauth2/compare/v2.0.20...v2.0.21
 [2.0.21t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.21
 [2.0.20]: https://github.com/ruby-oauth/oauth2/compare/v2.0.19...v2.0.20

data/README.md

@@ -1086,7 +1086,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.525-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.542-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/ruby-oauth/oauth2/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/oauth2/client.rb

@@ -159,8 +159,9 @@ module OAuth2
         end
         location = response.headers["location"]
         if location
-          full_location = response.response.env.url.merge(location)
-          request(verb, full_location, req_opts)
+          current_location = response.response.env.url
+          full_location = resolve_redirect_location(current_location, location)
+          request(verb, full_location, sanitize_redirect_options(req_opts, current_location, full_location))
         else
           error = Error.new(response)
           raise(error, "Got #{status} status code, but no Location header was present")
@@ -465,6 +466,36 @@ module OAuth2
       Response.new(response, parse: parse, snaky: snaky)
     end
 
+    def resolve_redirect_location(current_location, location)
+      safe_location =
+        if location.respond_to?(:start_with?) && location.start_with?("//")
+          "./#{location}"
+        else
+          location
+        end
+
+      current_location.merge(safe_location)
+    end
+
+    def sanitize_redirect_options(req_opts, current_location, next_location)
+      return req_opts unless cross_origin_redirect?(current_location, next_location)
+
+      headers = req_opts[:headers]
+      return req_opts unless headers && headers.any? { |key, _value| key.to_s.casecmp("Authorization").zero? }
+
+      safe_opts = req_opts.dup
+      safe_headers = headers.dup
+      safe_headers.delete_if { |key, _value| key.to_s.casecmp("Authorization").zero? }
+      safe_opts[:headers] = safe_headers
+      safe_opts
+    end
+
+    def cross_origin_redirect?(current_location, next_location)
+      current_location.scheme != next_location.scheme ||
+        current_location.host != next_location.host ||
+        current_location.port != next_location.port
+    end
+
     # Returns the authenticator object
     #
     # @return [Authenticator] the initialized Authenticator

data/lib/oauth2/version.rb

@@ -2,7 +2,7 @@
 
 module OAuth2
   module Version
-    VERSION = "2.0.21"
+    VERSION = "2.0.22"
   end
   VERSION = Version::VERSION # Traditional Constant Location
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: oauth2
 version: !ruby/object:Gem::Version
-  version: 2.0.21
+  version: 2.0.22
 platform: ruby
 authors:
 - Peter Boling
@@ -156,7 +156,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.4
+        version: 2.0.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -166,7 +166,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.4
+        version: 2.0.5
 - !ruby/object:Gem::Dependency
   name: version_gem
   requirement: !ruby/object:Gem::Requirement
@@ -176,7 +176,7 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.10
+        version: 1.1.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -186,7 +186,7 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.10
+        version: 1.1.11
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
@@ -196,7 +196,7 @@ dependencies:
         version: '2.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.1.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -206,7 +206,7 @@ dependencies:
         version: '2.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: 2.1.1
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -502,10 +502,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://oauth2.galtzo.com
-  source_code_uri: https://github.com/ruby-oauth/oauth2/tree/v2.0.21
-  changelog_uri: https://github.com/ruby-oauth/oauth2/blob/v2.0.21/CHANGELOG.md
+  source_code_uri: https://github.com/ruby-oauth/oauth2/tree/v2.0.22
+  changelog_uri: https://github.com/ruby-oauth/oauth2/blob/v2.0.22/CHANGELOG.md
   bug_tracker_uri: https://github.com/ruby-oauth/oauth2/issues
-  documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.21
+  documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.22
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/ruby-oauth/oauth2/wiki
   news_uri: https://www.railsbling.com/tags/oauth2