patron 0.6.4 → 0.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6490486dce02935cfdeac506f347834248752534
-  data.tar.gz: 2054357e312513173440405a32c69ed1270d6f10
+  metadata.gz: a7318f9bed9b99f36570d83e3c0de4fe77e9fa93
+  data.tar.gz: 15cf5d9064bb24ce550e31e15c87feacb6d9e2a5
 SHA512:
-  metadata.gz: 96c2adbfe66641accbb6647faab050405950338938caac845ba3948d981e8f3371f24fd6e3c308cf44cc19248dc56ddb857058546c11ba798eb34ab65b5769f2
-  data.tar.gz: 66e5369b422608d214b0b1654a9fd9cdf075c42f01194b70497b6d3976f7e442d5c0b8926109c418d7e489fedea10d2c72fcad3519d4f0a38b1f584d5d31b525
+  metadata.gz: 07b6971951e179505a4df277951b57c5b509679fb7e1515f400fdd954e897a9b191c879ba467e409d5ef310b6fee44b7608c26cbf80d0629e1c3574be25a0487
+  data.tar.gz: aee56e977fce8e5e629df192aa83a5a27d69dd66a767adac38adb5786e36d93186162bd6166a6292a0826e15dc4c466fc6e0e2e1c7de885fe59e40c53f3235fc

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+### 0.6.5
+
+* Prevent libCURL from doing requests to non-HTTP/HTTPS URLs, and from following redirects to such URLs
+
 ### 0.6.4
 
 * Set the default User-Agent string, since some sites require it (like the Github API).

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    patron (0.6.4)
+    patron (0.6.5)
 
 GEM
   remote: https://rubygems.org/

data/README.md

@@ -92,10 +92,14 @@ For sharing a resource of sessions between threads we recommend using the excell
 
 ## Requirements
 
-You need a recent version of libcurl in order to install this gem. On MacOS X
-the provided libcurl is sufficient. You will have to install the libcurl
+Patron uses encoding features of Ruby, so you need at least Ruby 1.9. Also, a
+recent version of libCURL is required. We recommend at least 7.19.4 because
+it [supports limiting the protocols](https://curl.haxx.se/libcurl/c/CURLOPT_PROTOCOLS.html),
+and that is very important for security - especially if you follow redirects. 
+
+On OSX the provided libcurl is sufficient. You will have to install the libcurl
 development packages on Debian or Ubuntu. Other Linux systems are probably
-similar. Windows users are on your own. Good luck with that.
+similar. For Windows we do not have an established build instruction at the moment, unfortunately.
 
 ## Installation
 

data/ext/patron/session_ext.c

@@ -470,7 +470,15 @@ static void set_options_from_request(VALUE self, VALUE request) {
     rb_raise(rb_eArgError, "Must provide a URL");
   }
   curl_easy_setopt(curl, CURLOPT_URL, StringValuePtr(url));
-
+  
+#ifdef CURLPROTO_HTTP
+  // Security: do not allow Curl to go looking on gopher/SMTP etc.
+  // Must prevent situations like this:
+  // https://hackerone.com/reports/115748
+  curl_easy_setopt(curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+  curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+#endif
+    
   timeout = rb_funcall(request, rb_intern("timeout"), 0);
   if (RTEST(timeout)) {
     curl_easy_setopt(curl, CURLOPT_TIMEOUT, FIX2INT(timeout));

data/lib/patron/version.rb

@@ -1,3 +1,3 @@
 module Patron
-  VERSION = "0.6.4"
+  VERSION = "0.6.5"
 end

data/spec/session_spec.rb

@@ -36,6 +36,27 @@ describe Patron::Session do
     @session.base_url = "http://localhost:9001"
   end
 
+  context 'when trying a non-HTTP(s) URL' do
+    forbidden_protos = %w( smb tftp imap smtp telnet dict ftp sftp scp file gopher )
+    forbidden_protos.each do |forbidden_proto|
+      it "should deny a #{forbidden_proto.upcase} request" do
+        @session.base_url = nil
+        expect {
+          @session.get('%s://localhost' % forbidden_proto)
+        }.to raise_error(Patron::UnsupportedProtocol)
+      end
+    end
+  end
+  
+  it 'does not follow a redirect to a non-HTTP/HTTPS URL' do
+    # The "/evil-redirect" servlet tries to do a redirect to SMTP,
+    # which can lead to exploits. By default, libCURL will just follow
+    # that redirect.
+    expect {
+      @session.get('/evil-redirect')
+    }.to raise_error(Patron::UnsupportedProtocol)
+  end
+  
   it "should work when forcing ipv4" do
     @session.force_ipv4 = true
     expect { @session.get("/test") }.to_not raise_error

data/spec/support/test_server.rb

@@ -108,6 +108,13 @@ class RedirectServlet < HTTPServlet::AbstractServlet
   end
 end
 
+class EvilRedirectServlet < HTTPServlet::AbstractServlet
+  def do_GET(req,res)
+    res['Location'] = "smtp://mailbox:secret@localhost"
+    res.status = 301
+  end
+end
+
 class TestPostBodyServlet < HTTPServlet::AbstractServlet
   include RespondWith
   def do_POST(req, res)
@@ -188,6 +195,7 @@ class PatronTestServer
     @server.mount("/testpatch", TestPatchBodyServlet)
     @server.mount("/timeout", TimeoutServlet)
     @server.mount("/redirect", RedirectServlet)
+    @server.mount("/evil-redirect", EvilRedirectServlet)
     @server.mount("/picture", PictureServlet)
     @server.mount("/setcookie", SetCookieServlet)
     @server.mount("/repetitiveheader", RepetitiveHeaderServlet)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: patron
 version: !ruby/object:Gem::Version
-  version: 0.6.4
+  version: 0.6.5
 platform: ruby
 authors:
 - Phillip Toland
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-01 00:00:00.000000000 Z
+date: 2016-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler