Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Merge pull request from GHSA-hcqf-fw2r-52g4

Browse source 
* Revert "Fix request URL normalisation for bare domain and 8-bit characters (#26285)"

This reverts commit 8891d8945d.

* Revert "Do not normalize URL before fetching it (#26219)"

This reverts commit fd284311e7.
This commit is contained in:
Claire 2023-09-19 16:52:52 +02:00 • committed by GitHub
parent 73ecc4de6e
commit 94893cf24f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 4 additions and 202 deletions
Download patch file Download diff file Expand all files Collapse all files

23
app/lib/request.rb
View file

@ -68,26 +68,13 @@ class Request
# about 15s in total
TIMEOUT = { connect_timeout: 5, read_timeout: 10, write_timeout: 10, read_deadline: 30 }.freeze
# Workaround for overly-eager decoding of percent-encoded characters in Addressable::URI#normalized_path
# https://github.com/sporkmonger/addressable/issues/366
URI_NORMALIZER = lambda do |uri|
uri = HTTP::URI.parse(uri)
HTTP::URI.new(
scheme: uri.normalized_scheme,
authority: uri.normalized_authority,
path: Addressable::URI.normalize_path(encode_non_ascii(uri.path)).presence || '/',
query: encode_non_ascii(uri.query)
)
end
include RoutingHelper
def initialize(verb, url, **options)
raise ArgumentError if url.blank?
@verb = verb
@url = URI_NORMALIZER.call(url)
@url = Addressable::URI.parse(url).normalize
@http_client = options.delete(:http_client)
@allow_local = options.delete(:allow_local)
@options = options.merge(socket_class: use_proxy? || @allow_local ? ProxySocket : Socket)
@ -151,14 +138,8 @@ class Request
%w(http https).include?(parsed_url.scheme) && parsed_url.host.present?
end
NON_ASCII_PATTERN = /[^\x00-\x7F]+/
def encode_non_ascii(str)
str&.gsub(NON_ASCII_PATTERN) { |substr| CGI.escape(substr.encode(Encoding::UTF_8)) }
end
def http_client
HTTP.use(:auto_inflate).use(normalize_uri: { normalizer: URI_NORMALIZER }).follow(max_hops: 3)
HTTP.use(:auto_inflate).follow(max_hops: 3)
end
end