ruby-proxy-headers 0.2.1 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b268cd14cb2ce0cd1b3c0a59ddf0c9020f65af6cd414b23202996d3868f837e
-  data.tar.gz: 16a7d3756a1bc7b0b90e85ce5b8dca41959f79a178238a051a256ca49b0e55fa
+  metadata.gz: 227e0393d4ab8a6f03fa72d69541f07a20c73cec9eb3458266dbaa0b74fee36d
+  data.tar.gz: 299ef710e77b061929ce18159f37e82f002c7a8522b5f0c5ed4319f3d2ab517f
 SHA512:
-  metadata.gz: 450bd0c6e87d23873d11f0970989743c8171772d38ba8db7c3094d8badfc7eb354ad690c4b8b19a0c881255e7613e07054ca113a7f64b0a3956a2d80aacc1cb7
-  data.tar.gz: 762c4662050a554d9b8e280766322ee5e4aee6611d9ed6fbd5414b79b3703bd5328398cb290e2ad4edb8c3a7cb46e95f3997b6f734c6d9eb5f12eb67e9f33c48
+  metadata.gz: deae95ea2297961bc962a5d9e476ec09b88c85a6a2ac741e1c5d1cb15972f1dc096f2b52e16a70aaca28a77ce04568f00a1109abd2edbdfee45a9727841bff61
+  data.tar.gz: 55096cb62498dc26f1c1695c8bc46213db91bea6be4c2d056af152cdbbabd07873bc646c2db07a2e36764f8cd8a78188942c77d15b784c3c71acc3e91e2f8a75

data/README.md

@@ -1,3 +1,4 @@
+[![Gem Version](https://badge.fury.io/rb/ruby-proxy-headers.svg)](https://badge.fury.io/rb/ruby-proxy-headers)
 # Ruby Proxy Headers
 
 Send and receive custom proxy headers during HTTPS `CONNECT` tunneling in modern Ruby HTTP workflows (for example [ProxyMesh](https://proxymesh.com) `X-ProxyMesh-IP` / `X-ProxyMesh-Country`).

data/lib/ruby_proxy_headers/connection.rb

@@ -31,6 +31,8 @@ module RubyProxyHeaders
     # @param target_port [Integer] Target port (default: 443)
     # @return [OpenSSL::SSL::SSLSocket] TLS-wrapped socket to target
     def connect(target_host, target_port = 443)
+      validate_connect_target!(target_host, target_port)
+
       # Connect to proxy
       @socket = TCPSocket.new(@proxy[:host], @proxy[:port])
       @socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
@@ -74,6 +76,7 @@ module RubyProxyHeaders
 
       # Add custom proxy headers
       @proxy_headers.each do |name, value|
+        RubyProxyHeaders.validate_header!(name, value)
         request_lines << "#{name}: #{value}"
       end
 
@@ -131,6 +134,10 @@ module RubyProxyHeaders
       @socket = ssl_socket
     end
 
+    def validate_connect_target!(host, port)
+      RubyProxyHeaders.validate_connect_target!(host, port)
+    end
+
     def raise_connect_error
       case @proxy_response_status
       when 407

data/lib/ruby_proxy_headers/net_http.rb

@@ -48,6 +48,12 @@ module RubyProxyHeaders
           @ssl_context = OpenSSL::SSL::SSLContext.new
         end
 
+        if use_ssl? && proxy?
+          # Fail before any socket I/O: CONNECT interpolates these into a raw request line.
+          RubyProxyHeaders.validate_connect_target!(conn_address, @port)
+          RubyProxyHeaders.validate_connect_target!(@address, @port)
+        end
+
         if proxy?
           conn_addr = proxy_address
           conn_port = proxy_port
@@ -82,6 +88,7 @@ module RubyProxyHeaders
             end
             if proxy_connect_request_headers&.any?
               proxy_connect_request_headers.each do |k, v|
+                RubyProxyHeaders.validate_header!(k, v)
                 buf << "#{k}: #{v}\r\n"
               end
             end

data/lib/ruby_proxy_headers/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyProxyHeaders
-  VERSION = '0.2.1'
+  VERSION = '0.2.3'
 end

data/lib/ruby_proxy_headers.rb

@@ -4,8 +4,35 @@ require_relative 'ruby_proxy_headers/version'
 require_relative 'ruby_proxy_headers/net_http'
 
 module RubyProxyHeaders
+  INVALID_HEADER_NAME_RE = /[\r\n\0]/
+  INVALID_HEADER_VALUE_RE = /[\r\n\0]/
+
   # CONNECT response headers from the last Net::HTTP-based proxied HTTPS request on this thread.
   def self.proxy_connect_response_headers
     Thread.current[:ruby_proxy_headers_connect_headers]
   end
+
+  # Raises ArgumentError if +name+ or +value+ contain CR, LF, or NUL bytes
+  # that would allow HTTP header injection in a raw CONNECT request.
+  def self.validate_header!(name, value)
+    if INVALID_HEADER_NAME_RE.match?(name.to_s)
+      raise ArgumentError, "proxy CONNECT header name contains invalid characters (CR, LF, or NUL): #{name.inspect}"
+    end
+    if INVALID_HEADER_VALUE_RE.match?(value.to_s)
+      raise ArgumentError, "proxy CONNECT header value contains invalid characters (CR, LF, or NUL): #{value.inspect}"
+    end
+  end
+
+  # Raises ArgumentError if +host+ or +port+ contain CR, LF, or NUL bytes that
+  # would allow HTTP request smuggling when interpolated into a CONNECT line.
+  def self.validate_connect_target!(host, port)
+    if INVALID_HEADER_VALUE_RE.match?(host.to_s)
+      raise ArgumentError,
+            "CONNECT target host contains invalid characters (CR, LF, or NUL): #{host.inspect}"
+    end
+    if INVALID_HEADER_VALUE_RE.match?(port.to_s)
+      raise ArgumentError,
+            "CONNECT target port contains invalid characters (CR, LF, or NUL): #{port.inspect}"
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-proxy-headers
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.3
 platform: ruby
 authors:
 - ProxyMesh
@@ -163,6 +163,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.18'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.18'
 description: |
   Extensions for Ruby HTTP stacks to send custom headers on HTTPS CONNECT to a proxy
   and read headers from the proxy CONNECT response (e.g. X-ProxyMesh-IP).
@@ -207,7 +221,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Custom proxy CONNECT headers for Ruby HTTP clients (ProxyMesh, etc.)
 test_files: []