diff options
author | Rahul Chauhan <rahulchauhankitps@gmail.com> | 2020-02-11 19:13:08 +0530 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-03-16 16:44:53 +0000 |
commit | f4f272f72c71fe1056f7658b767225139e797b27 (patch) | |
tree | 03bf49a9c532cb332c77a2a5bde6dd4cb6aeedaf /meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch | |
parent | 917d2fc42bc57f5f5f50e172a6928823a833ac80 (diff) | |
download | poky-f4f272f72c71fe1056f7658b767225139e797b27.tar.gz |
ruby: fix CVE-2019-16254
(From OE-Core rev: b8e6eb473f3697ab76f30ca8a0abe584d3d10fa6)
Signed-off-by: Rahul Chauhan <rahulchauhankitps@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch')
-rw-r--r-- | meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch | 106 |
1 files changed, 106 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch b/meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch new file mode 100644 index 0000000000..704c850c50 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch | |||
@@ -0,0 +1,106 @@ | |||
1 | From 18d5289b4579822e391b3f5c16541e6552e9f06c Mon Sep 17 00:00:00 2001 | ||
2 | From: Yusuke Endoh <mame@ruby-lang.org> | ||
3 | Date: Tue, 1 Oct 2019 12:29:18 +0900 | ||
4 | Subject: [PATCH] WEBrick: prevent response splitting and header injection | ||
5 | |||
6 | This is a follow up to d9d4a28f1cdd05a0e8dabb36d747d40bbcc30f16. | ||
7 | The commit prevented CRLR, but did not address an isolated CR or an | ||
8 | isolated LF. | ||
9 | |||
10 | Upstream-Status: Backport https://github.com/ruby/ruby/commit/3ce238b5f9795581eb84114dcfbdf4aa086bfecc | ||
11 | CVE: CVE-2019-16254 | ||
12 | |||
13 | Co-Authored-By: NARUSE, Yui <naruse@airemix.jp> | ||
14 | Signed-off-by: Rahul Chauhan <rahulchauhankitps@gmail.com> | ||
15 | --- | ||
16 | lib/webrick/httpresponse.rb | 3 ++- | ||
17 | test/webrick/test_httpresponse.rb | 46 +++++++++++++++++++++++++++++++++++++-- | ||
18 | 2 files changed, 46 insertions(+), 3 deletions(-) | ||
19 | |||
20 | diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb | ||
21 | index 6d77692..d26324c 100644 | ||
22 | --- a/lib/webrick/httpresponse.rb | ||
23 | +++ b/lib/webrick/httpresponse.rb | ||
24 | @@ -367,7 +367,8 @@ def set_error(ex, backtrace=false) | ||
25 | private | ||
26 | |||
27 | def check_header(header_value) | ||
28 | - if header_value =~ /\r\n/ | ||
29 | + header_value = header_value.to_s | ||
30 | + if /[\r\n]/ =~ header_value | ||
31 | raise InvalidHeader | ||
32 | else | ||
33 | header_value | ||
34 | diff --git a/test/webrick/test_httpresponse.rb b/test/webrick/test_httpresponse.rb | ||
35 | index 6263e0a..24a6968 100644 | ||
36 | --- a/test/webrick/test_httpresponse.rb | ||
37 | +++ b/test/webrick/test_httpresponse.rb | ||
38 | @@ -29,7 +29,7 @@ def setup | ||
39 | @res.keep_alive = true | ||
40 | end | ||
41 | |||
42 | - def test_prevent_response_splitting_headers | ||
43 | + def test_prevent_response_splitting_headers_crlf | ||
44 | res['X-header'] = "malicious\r\nCookie: hack" | ||
45 | io = StringIO.new | ||
46 | res.send_response io | ||
47 | @@ -39,7 +39,7 @@ def test_prevent_response_splitting_headers | ||
48 | refute_match 'hack', io.string | ||
49 | end | ||
50 | |||
51 | - def test_prevent_response_splitting_cookie_headers | ||
52 | + def test_prevent_response_splitting_cookie_headers_crlf | ||
53 | user_input = "malicious\r\nCookie: hack" | ||
54 | res.cookies << WEBrick::Cookie.new('author', user_input) | ||
55 | io = StringIO.new | ||
56 | @@ -50,6 +50,48 @@ def test_prevent_response_splitting_cookie_headers | ||
57 | refute_match 'hack', io.string | ||
58 | end | ||
59 | |||
60 | + def test_prevent_response_splitting_headers_cr | ||
61 | + res['X-header'] = "malicious\rCookie: hack" | ||
62 | + io = StringIO.new | ||
63 | + res.send_response io | ||
64 | + io.rewind | ||
65 | + res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) | ||
66 | + assert_equal '500', res.code | ||
67 | + refute_match 'hack', io.string | ||
68 | + end | ||
69 | + | ||
70 | + def test_prevent_response_splitting_cookie_headers_cr | ||
71 | + user_input = "malicious\rCookie: hack" | ||
72 | + res.cookies << WEBrick::Cookie.new('author', user_input) | ||
73 | + io = StringIO.new | ||
74 | + res.send_response io | ||
75 | + io.rewind | ||
76 | + res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) | ||
77 | + assert_equal '500', res.code | ||
78 | + refute_match 'hack', io.string | ||
79 | + end | ||
80 | + | ||
81 | + def test_prevent_response_splitting_headers_lf | ||
82 | + res['X-header'] = "malicious\nCookie: hack" | ||
83 | + io = StringIO.new | ||
84 | + res.send_response io | ||
85 | + io.rewind | ||
86 | + res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) | ||
87 | + assert_equal '500', res.code | ||
88 | + refute_match 'hack', io.string | ||
89 | + end | ||
90 | + | ||
91 | + def test_prevent_response_splitting_cookie_headers_lf | ||
92 | + user_input = "malicious\nCookie: hack" | ||
93 | + res.cookies << WEBrick::Cookie.new('author', user_input) | ||
94 | + io = StringIO.new | ||
95 | + res.send_response io | ||
96 | + io.rewind | ||
97 | + res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) | ||
98 | + assert_equal '500', res.code | ||
99 | + refute_match 'hack', io.string | ||
100 | + end | ||
101 | + | ||
102 | def test_304_does_not_log_warning | ||
103 | res.status = 304 | ||
104 | res.setup_header | ||
105 | -- | ||
106 | 2.7.4 | ||