102 lines
2.6 KiB
Diff
102 lines
2.6 KiB
Diff
commit 95ba9053e20ad8d113af37b3f1f4cbfff1f6a8f1
|
|
Author: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
|
|
Date: Wed Jul 7 10:38:10 2021 +0000
|
|
|
|
Fix StartTLS stripping vulnerability
|
|
|
|
Reported by Alexandr Savca in https://hackerone.com/reports/1178562
|
|
|
|
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
|
|
|
|
|
|
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
|
diff --git a/lib/net/imap.rb b/lib/net/imap.rb
|
|
index 1c7e89ba14..91df89b79e 100644
|
|
--- a/lib/net/imap.rb
|
|
+++ b/lib/net/imap.rb
|
|
@@ -1213,12 +1213,14 @@ def get_tagged_response(tag, cmd)
|
|
end
|
|
resp = @tagged_responses.delete(tag)
|
|
case resp.name
|
|
+ when /\A(?:OK)\z/ni
|
|
+ return resp
|
|
when /\A(?:NO)\z/ni
|
|
raise NoResponseError, resp
|
|
when /\A(?:BAD)\z/ni
|
|
raise BadResponseError, resp
|
|
else
|
|
- return resp
|
|
+ raise UnknownResponseError, resp
|
|
end
|
|
end
|
|
|
|
@@ -3714,6 +3716,10 @@ class BadResponseError < ResponseError
|
|
class ByeResponseError < ResponseError
|
|
end
|
|
|
|
+ # Error raised upon an unknown response from the server.
|
|
+ class UnknownResponseError < ResponseError
|
|
+ end
|
|
+
|
|
RESPONSE_ERRORS = Hash.new(ResponseError)
|
|
RESPONSE_ERRORS["NO"] = NoResponseError
|
|
RESPONSE_ERRORS["BAD"] = BadResponseError
|
|
diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb
|
|
index 936f4e0f42..81928cb8fe 100644
|
|
--- a/test/net/imap/test_imap.rb
|
|
+++ b/test/net/imap/test_imap.rb
|
|
@@ -127,6 +127,24 @@ def test_starttls
|
|
imap.disconnect
|
|
end
|
|
end
|
|
+
|
|
+ def test_starttls_stripping
|
|
+ starttls_stripping_test do |port|
|
|
+ imap = Net::IMAP.new("localhost", :port => port)
|
|
+ assert_raise(Net::IMAP::UnknownResponseError) do
|
|
+ imap.starttls(:ca_file => CA_FILE)
|
|
+ end
|
|
+ imap
|
|
+ end
|
|
+ end
|
|
+ end
|
|
+
|
|
+ def start_server
|
|
+ th = Thread.new do
|
|
+ yield
|
|
+ end
|
|
+ @threads << th
|
|
+ sleep 0.1 until th.stop?
|
|
end
|
|
|
|
def test_unexpected_eof
|
|
@@ -760,6 +760,27 @@ def starttls_test
|
|
end
|
|
end
|
|
|
|
+ def starttls_stripping_test
|
|
+ server = create_tcp_server
|
|
+ port = server.addr[1]
|
|
+ start_server do
|
|
+ sock = server.accept
|
|
+ begin
|
|
+ sock.print("* OK test server\r\n")
|
|
+ sock.gets
|
|
+ sock.print("RUBY0001 BUG unhandled command\r\n")
|
|
+ ensure
|
|
+ sock.close
|
|
+ server.close
|
|
+ end
|
|
+ end
|
|
+ begin
|
|
+ imap = yield(port)
|
|
+ ensure
|
|
+ imap.disconnect if imap && !imap.disconnected?
|
|
+ end
|
|
+ end
|
|
+
|
|
def create_tcp_server
|
|
return TCPServer.new(server_addr, 0)
|
|
end
|