rack-utf8_sanitizer 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 7122c2055da0fbed5a8f18a81078283040d0f614
-  data.tar.gz: 45526c40b0c2e96572f9511911c7fdc87d4c0a6a
+SHA256:
+  metadata.gz: 53093765db81984315b860f92ab0c1b51cc2e458147bc3cfb3d289424fb9b6d0
+  data.tar.gz: 21493f9709c2db974d65612a8f22328824f74118ee500f37eeafe957a3dd1d39
 SHA512:
-  metadata.gz: 766ad027d90baee2a60fdb4a6ac932ca94d42d8a65636ed3e50695e44b843a1512909966283da42484a9b243e8d26dc1836216fdbea42c78e1eec3cbc5be5d46
-  data.tar.gz: caade282f19e01c14ecce793b83adcc125a95f0f1d8b6c37f6ce2f0203518d7ec604776015265027a92ef45be1c21cb19680a5297d7995c3f347a994da8fa954
+  metadata.gz: 621f2ea1b68feaf198d558d22cdc9dbb22a1133cb61f755450c80757bc4e848a80b337657f0356d59ebef869633e348bb3392612ec7fe7954dc1134f03b04e5a
+  data.tar.gz: 917f05a6ed39b0656c84f60a076b072ed141418f15aa7b26d43c707be8268a739b1ce698955669bb8620f6e9f0c887e2c24a354f508a7e574af308c513e9da96

data/lib/rack/utf8_sanitizer.rb

@@ -63,6 +63,7 @@ module Rack
 
     def sanitize(env)
       sanitize_rack_input(env)
+      sanitize_cookies(env)
       env.each do |key, value|
         next if skip?(key)
 
@@ -105,7 +106,7 @@ module Rack
       return unless @sanitizable_content_types.any? {|type| content_type == type }
       uri_encoded = URI_ENCODED_CONTENT_TYPES.any? {|type| content_type == type}
 
-      if env["rack.input"]
+      if env['rack.input']
         sanitized_input = sanitize_io(env['rack.input'], uri_encoded)
 
         env['rack.input'] = sanitized_input
@@ -159,6 +160,20 @@ module Rack
       SanitizedRackInput.new(io, StringIO.new(sanitized_input))
     end
 
+    # Cookies need to be split and then sanitized as url encoded strings
+    # since the cookie string itself is not url encoded (separated by `;`),
+    # and the normal method of `sanitize_uri_encoded_string` would break
+    # later cookie parsing in the case that a cookie value contained an
+    # encoded `;`.
+    def sanitize_cookies(env)
+      return unless env['HTTP_COOKIE']
+
+      env['HTTP_COOKIE'] = env['HTTP_COOKIE']
+        .split(/[;,] */n)
+        .map { |cookie| sanitize_uri_encoded_string(cookie) }
+        .join('; ')
+    end
+
     # URI.encode/decode expect the input to be in ASCII-8BIT.
     # However, there could be invalid UTF-8 characters both in
     # raw and percent-encoded form.

data/rack-utf8_sanitizer.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |gem|
   gem.name          = "rack-utf8_sanitizer"
-  gem.version       = '1.5.0'
+  gem.version       = '1.6.0'
   gem.authors       = ["whitequark"]
   gem.license       = "MIT"
   gem.email         = ["whitequark@whitequark.org"]

data/test/test_utf8_sanitizer.rb

@@ -325,6 +325,34 @@ describe Rack::UTF8Sanitizer do
     end
   end
 
+  describe "with custom content-type" do
+    def request_env
+      {
+          "REQUEST_METHOD" => "GET",
+          "CONTENT_TYPE" => "application/json",
+          "HTTP_COOKIE" => @cookie,
+          "rack.input" => StringIO.new,
+      }
+    end
+
+    it "sanitizes bad http cookie" do
+      @cookie = "foo=bla; quux=bar\xED"
+      response_env = @app.(request_env)
+      response_env['HTTP_COOKIE'].should != @cookie
+      response_env['HTTP_COOKIE'].should == 'foo=bla; quux=bar%EF%BF%BD'
+    end
+
+    it "does not change ok http cookie" do
+      @cookie = "foo=bla; quux=bar"
+      response_env = @app.(request_env)
+      response_env['HTTP_COOKIE'].should == @cookie
+
+      @cookie = "foo=b%3bla; quux=b%20a%20r"
+      response_env = @app.(request_env)
+      response_env['HTTP_COOKIE'].should == @cookie
+    end
+  end
+
   describe "with custom content-type" do
     def request_env
       @plain_input = "foo bar лол".force_encoding('UTF-8')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-utf8_sanitizer
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - whitequark
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-26 00:00:00.000000000 Z
+date: 2018-06-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -110,7 +110,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2.2
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Rack::UTF8Sanitizer is a Rack middleware which cleans up invalid UTF8 characters