ruby-proxy-headers 0.2.2 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 30f82103fa860333b7df81d1b90271b048a8dd4e334bcb74caf5c762c2c7d695
-  data.tar.gz: 296932a159549772f64c66a305a794800f54a70f08b08f2e6e31cf5270d84c63
+  metadata.gz: 227e0393d4ab8a6f03fa72d69541f07a20c73cec9eb3458266dbaa0b74fee36d
+  data.tar.gz: 299ef710e77b061929ce18159f37e82f002c7a8522b5f0c5ed4319f3d2ab517f
 SHA512:
-  metadata.gz: 92f5f07379e76973c41159aadf9ff343dad72fd7df8ab14a6c090805b7af2c2f52af6ac048916de4a2f65f8e70efc4f11831d721ed16987b9859a14affc069bf
-  data.tar.gz: 87c47f3acd8ed3d0741b3075999f632e6998f59cdfb86606de02227fdf3fc9a72c78355964e048c29e8dae02d340d19f18b3b77ea3a131b92ad123e345a41329
+  metadata.gz: deae95ea2297961bc962a5d9e476ec09b88c85a6a2ac741e1c5d1cb15972f1dc096f2b52e16a70aaca28a77ce04568f00a1109abd2edbdfee45a9727841bff61
+  data.tar.gz: 55096cb62498dc26f1c1695c8bc46213db91bea6be4c2d056af152cdbbabd07873bc646c2db07a2e36764f8cd8a78188942c77d15b784c3c71acc3e91e2f8a75

data/lib/ruby_proxy_headers/connection.rb

@@ -135,14 +135,7 @@ module RubyProxyHeaders
     end
 
     def validate_connect_target!(host, port)
-      if RubyProxyHeaders::INVALID_HEADER_VALUE_RE.match?(host.to_s)
-        raise ArgumentError,
-              "CONNECT target host contains invalid characters (CR, LF, or NUL): #{host.inspect}"
-      end
-      if RubyProxyHeaders::INVALID_HEADER_VALUE_RE.match?(port.to_s)
-        raise ArgumentError,
-              "CONNECT target port contains invalid characters (CR, LF, or NUL): #{port.inspect}"
-      end
+      RubyProxyHeaders.validate_connect_target!(host, port)
     end
 
     def raise_connect_error

data/lib/ruby_proxy_headers/net_http.rb

@@ -48,6 +48,12 @@ module RubyProxyHeaders
           @ssl_context = OpenSSL::SSL::SSLContext.new
         end
 
+        if use_ssl? && proxy?
+          # Fail before any socket I/O: CONNECT interpolates these into a raw request line.
+          RubyProxyHeaders.validate_connect_target!(conn_address, @port)
+          RubyProxyHeaders.validate_connect_target!(@address, @port)
+        end
+
         if proxy?
           conn_addr = proxy_address
           conn_port = proxy_port

data/lib/ruby_proxy_headers/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyProxyHeaders
-  VERSION = '0.2.2'
+  VERSION = '0.2.3'
 end

data/lib/ruby_proxy_headers.rb

@@ -22,4 +22,17 @@ module RubyProxyHeaders
       raise ArgumentError, "proxy CONNECT header value contains invalid characters (CR, LF, or NUL): #{value.inspect}"
     end
   end
+
+  # Raises ArgumentError if +host+ or +port+ contain CR, LF, or NUL bytes that
+  # would allow HTTP request smuggling when interpolated into a CONNECT line.
+  def self.validate_connect_target!(host, port)
+    if INVALID_HEADER_VALUE_RE.match?(host.to_s)
+      raise ArgumentError,
+            "CONNECT target host contains invalid characters (CR, LF, or NUL): #{host.inspect}"
+    end
+    if INVALID_HEADER_VALUE_RE.match?(port.to_s)
+      raise ArgumentError,
+            "CONNECT target port contains invalid characters (CR, LF, or NUL): #{port.inspect}"
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-proxy-headers
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.2.3
 platform: ruby
 authors:
 - ProxyMesh