File 0008-CVE-2023-28362.patch of Package rubygem-actionpack-5_1.30088

Overview Repositories Revisions Requests Users Attributes Meta

File 0008-CVE-2023-28362.patch of Package rubygem-actionpack-5_1.30088

Index: actionpack-5.1.4/lib/action_controller/metal/redirecting.rb
===================================================================
--- actionpack-5.1.4.orig/lib/action_controller/metal/redirecting.rb
+++ actionpack-5.1.4/lib/action_controller/metal/redirecting.rb
@@ -5,6 +5,10 @@ module ActionController
     include AbstractController::Logger
     include ActionController::UrlFor
 
+    ILLEGAL_HEADER_VALUE_REGEX = /[\x00-\x08\x0A-\x1F]/.freeze
+
+    class UnsafeRedirectError < StandardError; end
+
     # Redirects the browser to the target specified in +options+. This parameter can be any one of:
     #
     # * <tt>Hash</tt> - The URL will be generated by calling url_for with the +options+.
@@ -58,7 +62,11 @@ module ActionController
       raise AbstractController::DoubleRenderError if response_body
 
       self.status        = _extract_redirect_to_status(options, response_status)
-      self.location      = _compute_redirect_to_location(request, options)
+
+      redirect_to_location = _compute_redirect_to_location(request, options)
+      _ensure_url_is_http_header_safe(redirect_to_location)
+
+      self.location      = redirect_to_location
       self.response_body = "<html><body>You are being <a href=\"#{ERB::Util.unwrapped_html_escape(response.location)}\">redirected</a>.</body></html>"
     end
 
@@ -118,5 +126,16 @@ module ActionController
           302
         end
       end
+
+      def _ensure_url_is_http_header_safe(url)
+        # Attempt to comply with the set of valid token characters
+        # defined for an HTTP header value in
+        # https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6
+        if url.match(ILLEGAL_HEADER_VALUE_REGEX)
+          msg = "The redirect URL #{url} contains one or more illegal HTTP header field character. " \
+            "Set of legal characters defined in https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.6"
+          raise UnsafeRedirectError, msg
+        end
+      end
   end
 end

Places

File 0008-CVE-2023-28362.patch of Package rubygem-actionpack-5_1.30088

Places