utopia 2.32.0 → 2.32.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2617b169570e3ea31076f246227e4418b59c7f04922b3385a3dabe2488d3202b
-  data.tar.gz: 184296cc495e8f7590004e3c3dfb65f55e339df0d5d8a519e6ad05f77b187f75
+  metadata.gz: 39b95a5f8c45c77816846900c9d99e7bb306bdbc589c60b10e71d045260d6107
+  data.tar.gz: 1c82a315db0de1c3738c6a03a4569fadaaf0aa031850f672976b29f71fd70087
 SHA512:
-  metadata.gz: 10b7584f9f058cd3d9db2590fab1386448f089c20f4f2a87244eff850e61b8446b5e741d969d8cf2d31340f2084a28af6232ab69849b29a0001fcf6b2765c3cb
-  data.tar.gz: 93445d1b6b9499a4e4949ec93ddaa9e559797a4ce4b0ee496e7113a1925e0e855d3e897f3cf051c3b8881d8af0ba2c70d61a55d328fcd6c774f9567d197e0296
+  metadata.gz: 01e866be2be3f5465b69a1de18ef976b2e4edbaa5facc9a168291e87965039afdc149df0157b7f50236ecd453a86b2ad93d34e548809dc3ae08b44c4a21a62f6
+  data.tar.gz: d8c87f177f7572795bf416c9ec6b560e2b3e357446c86d0853b8f47094d56e46413b112953b53bfa2cc27b6abc15baa3973f2862d21928f8056b46947cd66419

data/lib/utopia/redirection.rb

@@ -89,12 +89,15 @@ module Utopia
 				"max-age=#{self.max_age}"
 			end
 			
-			def headers(location)
-				{HTTP::LOCATION => location, HTTP::CACHE_CONTROL => self.cache_control}
+			def make_headers(location)
+				{
+					HTTP::LOCATION => location,
+					HTTP::CACHE_CONTROL => self.cache_control
+				}
 			end
 			
 			def redirect(location)
-				return [self.status, self.headers(location), []]
+				return [self.status, self.make_headers(location), []]
 			end
 			
 			def [] path
@@ -102,7 +105,10 @@ module Utopia
 			end
 			
 			def call(env)
-				path = env[Rack::PATH_INFO]
+				# Normalize the path to remove redundant slashes, `.` and `..` segments.
+				# This prevents protocol-relative redirect URLs (e.g. //evil.com/index)
+				# from being generated when PATH_INFO contains a double leading slash.
+				path = Path.create(env[Rack::PATH_INFO]).simplify.to_s
 				
 				if redirection = self[path]
 					return redirection

data/lib/utopia/version.rb

@@ -4,5 +4,5 @@
 # Copyright, 2009-2025, by Samuel Williams.
 
 module Utopia
-	VERSION = "2.32.0"
+	VERSION = "2.32.1"
 end

data/readme.md

@@ -31,6 +31,10 @@ Please see the [project documentation](https://socketry.github.io/utopia/) for m
 
 Please see the [project releases](https://socketry.github.io/utopia/releases/index) for all releases.
 
+### Unreleasd
+
+  - **Security** Fix handling of redirects that start with `//` to prevent open redirect vulnerabilities.
+
 ### v2.31.0
 
   - Add agent context.

data/releases.md

@@ -1,5 +1,9 @@
 # Releases
 
+## Unreleasd
+
+  - **Security** Fix handling of redirects that start with `//` to prevent open redirect vulnerabilities.
+
 ## v2.31.0
 
   - Add agent context.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: utopia
 version: !ruby/object:Gem::Version
-  version: 2.32.0
+  version: 2.32.1
 platform: ruby
 authors:
 - Samuel Williams
@@ -367,7 +367,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Utopia is a framework for building dynamic content-driven websites.
 test_files: []