ssrf_filter 1.0.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 855ec5e3486aa13ddfebb55690b3e7d30f6148d2
-  data.tar.gz: 6df3da50c9087158e4cb2911a290ba694406e111
+  metadata.gz: b2fc0cf2f5ff4aabb135f53097a1acde319aea21
+  data.tar.gz: e64612c1c5bf85747f5549128e505c7dfdfdf3f9
 SHA512:
-  metadata.gz: ac67704b7c90ba7c2b7a43b94e1d2a7f9230776f5754e195cc74076abe1a0e90c2cfa05b43fe5d8d7da40359729e7df056f15f6c00b16763e37c8f8e5e6d30a9
-  data.tar.gz: 0f0f93dc6016603c49d151006c70564f9eb9dfc60ddbe4cd28b537f091ae4ba0b4830739987e70d9deaff307a18a2c0f5f89a19c5cb6ca10188c1b1002728b5a
+  metadata.gz: 8e9828a7a39e4a354d565ddf7d058d087b4b71841525d0963a3139d92340c4f0422d316f6db9ede9cfa789ad5f8942eeba77e5f627d9c775dcf3d5b2f8f5b649
+  data.tar.gz: 7296ca44593dca4f48e8eefd84212c79fbb7a355e2fe270c74527d93aecbc0d98c2ce5f81c7efa0dff14413460a949cab4c968e585e82b17f670627fb0eac1bb

data/lib/ssrf_filter/ssrf_filter.rb

@@ -93,6 +93,9 @@ class SsrfFilter
   class TooManyRedirects < Error
   end
 
+  class CRLFInjection < Error
+  end
+
   %i[get put post delete].each do |method|
     define_singleton_method(method) do |url, options = {}, &block|
       original_url = url
@@ -166,6 +169,7 @@ class SsrfFilter
     request.body = options[:body] if options[:body]
 
     block.call(request) if block_given?
+    validate_request(request)
 
     use_ssl = uri.scheme == 'https'
     with_forced_hostname(hostname) do
@@ -176,6 +180,19 @@ class SsrfFilter
   end
   private_class_method :fetch_once
 
+  def self.validate_request(request)
+    # RFC822 allows multiline "folded" headers:
+    # https://tools.ietf.org/html/rfc822#section-3.1
+    # In practice if any user input is ever supplied as a header key/value, they'll get
+    # arbitrary header injection and possibly connect to a different host, so we block it
+    request.each do |header, value|
+      if header.count("\r\n") != 0 || value.count("\r\n") != 0
+        raise CRLFInjection, "CRLF injection in header #{header} with value #{value}"
+      end
+    end
+  end
+  private_class_method :validate_request
+
   def self.patch_ssl_socket!
     return if instance_variable_defined?(:@patched_ssl_socket)
 

data/lib/ssrf_filter/version.rb

@@ -1,3 +1,3 @@
 class SsrfFilter
-  VERSION = '1.0.1'.freeze
+  VERSION = '1.0.2'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ssrf_filter
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Arkadiy Tetelman
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-26 00:00:00.000000000 Z
+date: 2017-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -124,7 +124,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.12
+rubygems_version: 2.4.6
 signing_key: 
 specification_version: 4
 summary: A gem that makes it easy to prevent server side request forgery (SSRF) attacks