1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Check for invalid hex escapes in URI#query=

Browse Source 
Fixes [Bug #11275]
This commit is contained in:
Jeremy Evans 2019-07-05 14:45:19 -07:00
parent 8feb8c9bb7
commit 7909f06212
Notes: git 2019-10-08 23:31:25 +09:00 
Merged: https://github.com/ruby/ruby/pull/2535
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/uri/generic.rb
View File

@ -836,6 +836,7 @@ module URI
v.encode!(Encoding::UTF_8) rescue nil v.encode!(Encoding::UTF_8) rescue nil
v.delete!("\t\r\n") v.delete!("\t\r\n")
v.force_encoding(Encoding::ASCII_8BIT) v.force_encoding(Encoding::ASCII_8BIT)
raise InvalidURIError, "invalid percent escape: #{$1}" if /(%\H\H)/n.match(v)
v.gsub!(/(?!%\h\h|[!$-&(-;=?-_a-~])./n.freeze){'%%%02X' % $&.ord} v.gsub!(/(?!%\h\h|[!$-&(-;=?-_a-~])./n.freeze){'%%%02X' % $&.ord}
v.force_encoding(Encoding::US_ASCII) v.force_encoding(Encoding::US_ASCII)
@query = v @query = v

5
test/uri/test_parser.rb
View File

@ -40,6 +40,11 @@ class URI::TestParser < Test::Unit::TestCase
uri_to_ary(u1)) uri_to_ary(u1))
end end
def test_parse_query_pct_encoded
assert_equal('q=%32!$&-/?.09;=:@AZ_az~', URI.parse('https://www.example.com/search?q=%32!$&-/?.09;=:@AZ_az~').query)
assert_raise(URI::InvalidURIError) { URI.parse('https://www.example.com/search?q=%XX') }
end
def test_raise_bad_uri_for_integer def test_raise_bad_uri_for_integer
assert_raise(URI::InvalidURIError) do assert_raise(URI::InvalidURIError) do
URI.parse(1) URI.parse(1)