savon 2.18.0 → 2.18.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b824b46b6baa9ec754839a85d8f4225b62ba562b4d060143c6b02cd41e4880f8
-  data.tar.gz: fbaf6f7ed2607e3c24d356c6ffb282f089b1426fc89b8fdcde5c01918c657e9a
+  metadata.gz: cec32bb7e6cf1477f3d93ab0befe29d05386220c73c46d62ab747bf822f591f3
+  data.tar.gz: 2c18c7678d283d3f8e29cb18bdce837a515afa0615cfe254e3702063caebee93
 SHA512:
-  metadata.gz: efd307c9e7dffa95ddccedf76b3bc675f27c3974d8742722ff2ebfb50b173ca687dd83a6a91fd97f637a56e5057e928d0dfa9adbcdfb0efb6c5c639215ba620f
-  data.tar.gz: 5170029557b974cb66c5adb409d339c3a2d044ee0427aca330e275878afbfbaf59d0d4f5c51bdd63fd9a68d1c4ec8720e617ac3ce09ad64cb59645d2872a948e
+  metadata.gz: ae62d330b6fb3ade1fd4a78a4cbec0a2e79f3511dc9b60ba234939f02c489588d9651953d3adbf4326aab07d0765be9eda8dc1c5aa9db0fc21a5093087660279
+  data.tar.gz: 6ad397a186b317a3e9a1ba9caf125b54476dccaffdc8fac599653824e32686fa772075dcd504da037545f5d1f60bbdccad3d89be279da5cb840832e9dccca9c4

data/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.18.1] - 2026-11-06
+
+### Security
+
+* The outbound `SOAPAction` header now rejects control characters to prevent HTTP header injection ([GHSA-57m8-w3r7-5p3w](https://github.com/savonrb/savon/security/advisories/GHSA-57m8-w3r7-5p3w)). A crafted WSDL can encode a carriage return or line feed in its `soapAction` attribute as the character references `
` and `
`, which survive XML attribute normalization and reach the header as real control characters. The httpclient adapter sent such a header unchecked, so it split on the wire and let an attacker inject further request headers. HTTPI picks httpclient automatically whenever the gem is installed, so the default configuration was affected. Both transports now validate the outgoing headers before the request is sent. A `SOAPAction` containing CR, LF, or NUL raises `Savon::InvalidHeaderError`, whether it comes from the WSDL, the `:soap_action` option, or the `:headers` option under any key spelling. With the net/http adapter, CR and LF used to raise net/http's own `ArgumentError`. A leading or trailing newline in a `:headers` value was stripped silently, and NUL was sent as-is. All of these now raise `Savon::InvalidHeaderError`. Thanks to @SDX442 for securely disclosing this.
+
 ## [2.18.0] - 2026-11-05
 
 ### Added
@@ -15,7 +21,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
-* `Savon::Model.operations` and `.all_operations` no longer rely on a hand-maintained list of reserved names. The guard now derives its denylist from the model's own ancestor chains — every method instances respond to plus every method the class object responds to — so a WSDL operation can never shadow an existing method. This closes the `class`/`public_send` bypass (unbounded recursion via the generated `self.class.public_send(...)` bodies, hijacked reflective dispatch) and the whole class of follow-on reports (`new`, `freeze`, `send`, …) by construction instead of one advisory at a time. Re-registering an already-defined operation is still allowed; anything else that collides raises `ArgumentError`. Call such operations explicitly through `model.client.call(:operation, ...)`.
+* `Savon::Model.operations` and `.all_operations` no longer rely on a hand-maintained list of reserved names ([GHSA-hjvq-xxqv-7jxh](https://github.com/savonrb/savon/security/advisories/GHSA-hjvq-xxqv-7jxh)). The guard now derives its denylist from the model's own ancestor chains — every method instances respond to plus every method the class object responds to — so a WSDL operation can never shadow an existing method. This closes the `class`/`public_send` bypass (unbounded recursion via the generated `self.class.public_send(...)` bodies, hijacked reflective dispatch) and the whole class of follow-on reports (`new`, `freeze`, `send`, …) by construction instead of one advisory at a time. Re-registering an already-defined operation is still allowed; anything else that collides raises `ArgumentError`. Call such operations explicitly through `model.client.call(:operation, ...)`. Thanks to @manus-pi for securely disclosing this.
 
 ### Fixed
 
@@ -37,7 +43,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
-* `Savon::Model.operations` and `.all_operations` now reject names that normalize to reserved model methods with `ArgumentError`, before defining any methods. This prevents a WSDL operation named `client` from overwriting the client accessor and causing unbounded recursion. Call operations with reserved names explicitly through `model.client.call(:client, ...)`.
+* `Savon::Model.operations` and `.all_operations` now reject names that normalize to reserved model methods with `ArgumentError`, before defining any methods ([GHSA-x99v-rwvj-g9p5](https://github.com/savonrb/savon/security/advisories/GHSA-x99v-rwvj-g9p5)). This prevents a WSDL operation named `client` from overwriting the client accessor and causing unbounded recursion. Call operations with reserved names explicitly through `model.client.call(:client, ...)`. Thanks to @arpitjain099 for securely disclosing this.
 
 ## [2.17.4] - 2026-07-03
 
@@ -1296,6 +1302,9 @@ Pay attention to the following list and read the updated Wiki: http://wiki.githu
 
 * Complete rewrite and public release.
 
+[2.18.1]: https://github.com/savonrb/savon/compare/v2.18.0...v2.18.1
+[2.18.0]: https://github.com/savonrb/savon/compare/v2.17.5...v2.18.0
+[2.17.5]: https://github.com/savonrb/savon/compare/v2.17.4...v2.17.5
 [2.17.4]: https://github.com/savonrb/savon/compare/v2.17.3...v2.17.4
 [2.17.3]: https://github.com/savonrb/savon/compare/v2.17.2...v2.17.3
 [2.17.2]: https://github.com/savonrb/savon/compare/v2.17.1...v2.17.2

data/lib/savon/transport/faraday.rb

@@ -2,6 +2,7 @@
 
 require "savon/transport/logging"
 require "savon/transport/response"
+require "savon/transport/header_validation"
 
 module Savon
   module Transport
@@ -15,6 +16,7 @@ module Savon
     # the caller's responsibility via client.faraday before any call is made.
     class Faraday
       include Logging
+      include HeaderValidation
 
       # @param connection [Faraday::Connection] the memoized connection from client.faraday
       # @param globals    [Savon::GlobalOptions] the client-level options
@@ -79,6 +81,8 @@ module Savon
         # soap_headers are lowest priority
         soap_headers.each do |k, v| headers[k] ||= v end
 
+        validate_soap_action_header!(headers)
+
         cookie_header = format_cookies(locals[:cookies])
         headers["Cookie"] = cookie_header if cookie_header
 

data/lib/savon/transport/header_validation.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Savon
+  module Transport
+    # Validates outbound HTTP header values before a transport sends them.
+    #
+    # A value that carries control characters cannot be sent safely.
+    # A carriage return or line feed splits the header on the wire,
+    # which lets an attacker inject further request headers.
+    # A header value can be assembled from input the caller does not fully control,
+    # so it is checked here rather than trusted where it is built.
+    #
+    # The check runs at the transport layer on the fully merged header set,
+    # so it covers every source of a value alike. It is the policing half of
+    # a deliberate split: the request headers are built elsewhere, this module
+    # decides whether they may be sent.
+    #
+    # RFC 9110 §5.5 (field values)
+    module HeaderValidation
+      # Control characters that must never appear in an HTTP header value.
+      # A carriage return or line feed splits the header, a NUL truncates it.
+      ILLEGAL_HEADER_CHARACTERS = /[\r\n\0]/
+      private_constant :ILLEGAL_HEADER_CHARACTERS
+
+      private
+
+      # Validates every SOAPAction header and raises if one is unsafe.
+      #
+      # The SOAPAction value can come from untrusted WSDL input, which may encode
+      # a carriage return or line feed as the character references +
+ and +
+.
+      # These survive XML attribute-value normalization and reach the header as real
+      # control characters.
+      #
+      # The merged headers are a plain Hash, so a caller can add a SOAPAction under
+      # a Symbol or a differently cased key next to the default String key.
+      # Some adapters send both, so every key that names SOAPAction is checked,
+      # matched case-insensitively.
+      #
+      # Pure validation. The value is never trimmed, stripped, or encoded.
+      # A header that cannot be sent safely is rejected, not repaired.
+      # Leading, interior, and trailing control characters all fail.
+      # The value is checked as raw bytes, so a non-String value or a string
+      # with an invalid encoding never raises here.
+      # The offending value is included in the message because it's not a secret.
+      #
+      # SOAP 1.1 §6.1.1 (SOAPAction HTTP header)
+      #
+      # @param headers [Hash{String, Symbol => Object}] the merged outbound HTTP headers
+      # @return [void]
+      # @raise [Savon::InvalidHeaderError] when a SOAPAction contains CR, LF, or NUL
+      def validate_soap_action_header!(headers)
+        headers.each do |key, value|
+          next unless value && key.to_s.casecmp?("SOAPAction")
+          next unless ILLEGAL_HEADER_CHARACTERS.match?(value.to_s.b)
+
+          raise InvalidHeaderError, "The SOAPAction header contains illegal control " \
+                                    "characters (CR, LF, or NUL): #{value.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/savon/transport/httpi.rb

@@ -3,6 +3,7 @@
 require "httpi"
 require "savon/transport/logging"
 require "savon/transport/response"
+require "savon/transport/header_validation"
 
 module Savon
   module Transport
@@ -14,6 +15,7 @@ module Savon
     #   * request execution
     class HTTPI
       include Logging
+      include HeaderValidation
 
       # @param globals [Savon::GlobalOptions] the client-level options
       def initialize(globals)
@@ -63,6 +65,8 @@ module Savon
         # soap_headers are lowest priority
         soap_headers.each do |k, v| headers[k] ||= v end
 
+        validate_soap_action_header!(headers)
+
         http_request = ::HTTPI::Request.new
         http_request.url = url
         http_request.body = body

data/lib/savon/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Savon
-  VERSION = '2.18.0'
+  VERSION = '2.18.1'
 end

data/lib/savon.rb

@@ -7,6 +7,10 @@ module Savon
   UnknownOperationError = Class.new(Error)
   InvalidResponseError  = Class.new(Error)
 
+  # Raised when a resolved HTTP header value cannot be sent safely,
+  # for example a SOAPAction carrying control characters from a crafted WSDL.
+  InvalidHeaderError    = Class.new(Error)
+
   def self.client(globals = {}, &block)
     Client.new(globals, &block)
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: savon
 version: !ruby/object:Gem::Version
-  version: 2.18.0
+  version: 2.18.1
 platform: ruby
 authors:
 - Daniel Harrington
@@ -291,6 +291,7 @@ files:
 - lib/savon/soap_fault.rb
 - lib/savon/string_utils.rb
 - lib/savon/transport/faraday.rb
+- lib/savon/transport/header_validation.rb
 - lib/savon/transport/httpi.rb
 - lib/savon/transport/logging.rb
 - lib/savon/transport/response.rb