archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-23 21:14:23 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

[ruby/cgi] Check cookie name/path/domain characters

Browse source 
https://hackerone.com/reports/1204977

30107a4797
This commit is contained in:
Nobuyoshi Nakada 2022-08-16 18:36:12 +09:00 • committed by git
parent cf05c202ce
commit c05f85f373
2 changed files with 100 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

64
test/cgi/test_cgi_cookie.rb
View file

@ -118,6 +118,70 @@ class CGICookieTest < Test::Unit::TestCase
end
def test_cgi_cookie_domain_injection_into_name
name = "a=b; domain=example.com;"
path = "/"
domain = "example.jp"
assert_raise(ArgumentError) do
CGI::Cookie.new('name' => name,
'value' => "value",
'domain' => domain,
'path' => path)
end
end
def test_cgi_cookie_newline_injection_into_name
name = "a=b;\r\nLocation: http://example.com#"
path = "/"
domain = "example.jp"
assert_raise(ArgumentError) do
CGI::Cookie.new('name' => name,
'value' => "value",
'domain' => domain,
'path' => path)
end
end
def test_cgi_cookie_multibyte_injection_into_name
name = "a=b;\u3042"
path = "/"
domain = "example.jp"
assert_raise(ArgumentError) do
CGI::Cookie.new('name' => name,
'value' => "value",
'domain' => domain,
'path' => path)
end
end
def test_cgi_cookie_injection_into_path
name = "name"
path = "/; samesite=none"
domain = "example.jp"
assert_raise(ArgumentError) do
CGI::Cookie.new('name' => name,
'value' => "value",
'domain' => domain,
'path' => path)
end
end
def test_cgi_cookie_injection_into_domain
name = "name"
path = "/"
domain = "example.jp; samesite=none"
assert_raise(ArgumentError) do
CGI::Cookie.new('name' => name,
'value' => "value",
'domain' => domain,
'path' => path)
end
end
instance_methods.each do |method|
private method if method =~ /^test_(.*)/ && $1 != ENV['TEST']