ruby-proxy-headers 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b268cd14cb2ce0cd1b3c0a59ddf0c9020f65af6cd414b23202996d3868f837e
-  data.tar.gz: 16a7d3756a1bc7b0b90e85ce5b8dca41959f79a178238a051a256ca49b0e55fa
+  metadata.gz: 30f82103fa860333b7df81d1b90271b048a8dd4e334bcb74caf5c762c2c7d695
+  data.tar.gz: 296932a159549772f64c66a305a794800f54a70f08b08f2e6e31cf5270d84c63
 SHA512:
-  metadata.gz: 450bd0c6e87d23873d11f0970989743c8171772d38ba8db7c3094d8badfc7eb354ad690c4b8b19a0c881255e7613e07054ca113a7f64b0a3956a2d80aacc1cb7
-  data.tar.gz: 762c4662050a554d9b8e280766322ee5e4aee6611d9ed6fbd5414b79b3703bd5328398cb290e2ad4edb8c3a7cb46e95f3997b6f734c6d9eb5f12eb67e9f33c48
+  metadata.gz: 92f5f07379e76973c41159aadf9ff343dad72fd7df8ab14a6c090805b7af2c2f52af6ac048916de4a2f65f8e70efc4f11831d721ed16987b9859a14affc069bf
+  data.tar.gz: 87c47f3acd8ed3d0741b3075999f632e6998f59cdfb86606de02227fdf3fc9a72c78355964e048c29e8dae02d340d19f18b3b77ea3a131b92ad123e345a41329

data/README.md

@@ -1,3 +1,4 @@
+[![Gem Version](https://badge.fury.io/rb/ruby-proxy-headers.svg)](https://badge.fury.io/rb/ruby-proxy-headers)
 # Ruby Proxy Headers
 
 Send and receive custom proxy headers during HTTPS `CONNECT` tunneling in modern Ruby HTTP workflows (for example [ProxyMesh](https://proxymesh.com) `X-ProxyMesh-IP` / `X-ProxyMesh-Country`).

data/lib/ruby_proxy_headers/connection.rb

@@ -31,6 +31,8 @@ module RubyProxyHeaders
     # @param target_port [Integer] Target port (default: 443)
     # @return [OpenSSL::SSL::SSLSocket] TLS-wrapped socket to target
     def connect(target_host, target_port = 443)
+      validate_connect_target!(target_host, target_port)
+
       # Connect to proxy
       @socket = TCPSocket.new(@proxy[:host], @proxy[:port])
       @socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1)
@@ -74,6 +76,7 @@ module RubyProxyHeaders
 
       # Add custom proxy headers
       @proxy_headers.each do |name, value|
+        RubyProxyHeaders.validate_header!(name, value)
         request_lines << "#{name}: #{value}"
       end
 
@@ -131,6 +134,17 @@ module RubyProxyHeaders
       @socket = ssl_socket
     end
 
+    def validate_connect_target!(host, port)
+      if RubyProxyHeaders::INVALID_HEADER_VALUE_RE.match?(host.to_s)
+        raise ArgumentError,
+              "CONNECT target host contains invalid characters (CR, LF, or NUL): #{host.inspect}"
+      end
+      if RubyProxyHeaders::INVALID_HEADER_VALUE_RE.match?(port.to_s)
+        raise ArgumentError,
+              "CONNECT target port contains invalid characters (CR, LF, or NUL): #{port.inspect}"
+      end
+    end
+
     def raise_connect_error
       case @proxy_response_status
       when 407

data/lib/ruby_proxy_headers/net_http.rb

@@ -82,6 +82,7 @@ module RubyProxyHeaders
             end
             if proxy_connect_request_headers&.any?
               proxy_connect_request_headers.each do |k, v|
+                RubyProxyHeaders.validate_header!(k, v)
                 buf << "#{k}: #{v}\r\n"
               end
             end

data/lib/ruby_proxy_headers/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyProxyHeaders
-  VERSION = '0.2.1'
+  VERSION = '0.2.2'
 end

data/lib/ruby_proxy_headers.rb

@@ -4,8 +4,22 @@ require_relative 'ruby_proxy_headers/version'
 require_relative 'ruby_proxy_headers/net_http'
 
 module RubyProxyHeaders
+  INVALID_HEADER_NAME_RE = /[\r\n\0]/
+  INVALID_HEADER_VALUE_RE = /[\r\n\0]/
+
   # CONNECT response headers from the last Net::HTTP-based proxied HTTPS request on this thread.
   def self.proxy_connect_response_headers
     Thread.current[:ruby_proxy_headers_connect_headers]
   end
+
+  # Raises ArgumentError if +name+ or +value+ contain CR, LF, or NUL bytes
+  # that would allow HTTP header injection in a raw CONNECT request.
+  def self.validate_header!(name, value)
+    if INVALID_HEADER_NAME_RE.match?(name.to_s)
+      raise ArgumentError, "proxy CONNECT header name contains invalid characters (CR, LF, or NUL): #{name.inspect}"
+    end
+    if INVALID_HEADER_VALUE_RE.match?(value.to_s)
+      raise ArgumentError, "proxy CONNECT header value contains invalid characters (CR, LF, or NUL): #{value.inspect}"
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-proxy-headers
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - ProxyMesh
@@ -163,6 +163,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.6'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.18'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.18'
 description: |
   Extensions for Ruby HTTP stacks to send custom headers on HTTPS CONNECT to a proxy
   and read headers from the proxy CONNECT response (e.g. X-ProxyMesh-IP).
@@ -207,7 +221,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Custom proxy CONNECT headers for Ruby HTTP clients (ProxyMesh, etc.)
 test_files: []