mame	2017-09-14 20:16:23 +0900 (Thu, 14 Sep 2017)

  New Revision: 59897

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=59897

  Log:
    lib/webrick/log.rb: sanitize any type of logs
    
    It had failed to sanitize some type of exception messages.  Reported and
    patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363

  Modified files:
    trunk/lib/webrick/httpstatus.rb
    trunk/lib/webrick/log.rb
    trunk/test/webrick/test_httpauth.rb
Index: lib/webrick/log.rb
===================================================================
--- lib/webrick/log.rb	(revision 59896)
+++ lib/webrick/log.rb	(revision 59897)
@@ -118,10 +118,10 @@ module WEBrick https://github.com/ruby/ruby/blob/trunk/lib/webrick/log.rb#L118
     # * Otherwise it will return +arg+.inspect.
     def format(arg)
       if arg.is_a?(Exception)
-        "#{arg.class}: #{arg.message}\n\t" <<
+        "#{arg.class}: #{AccessLog.escape(arg.message)}\n\t" <<
         arg.backtrace.join("\n\t") << "\n"
       elsif arg.respond_to?(:to_str)
-        arg.to_str
+        AccessLog.escape(arg.to_str)
       else
         arg.inspect
       end
Index: lib/webrick/httpstatus.rb
===================================================================
--- lib/webrick/httpstatus.rb	(revision 59896)
+++ lib/webrick/httpstatus.rb	(revision 59897)
@@ -23,10 +23,6 @@ module WEBrick https://github.com/ruby/ruby/blob/trunk/lib/webrick/httpstatus.rb#L23
     ##
     # Root of the HTTP status class hierarchy
     class Status < StandardError
-      def initialize(*args) # :nodoc:
-        args[0] = AccessLog.escape(args[0]) unless args.empty?
-        super(*args)
-      end
       class << self
         attr_reader :code, :reason_phrase # :nodoc:
       end
Index: test/webrick/test_httpauth.rb
===================================================================
--- test/webrick/test_httpauth.rb	(revision 59896)
+++ test/webrick/test_httpauth.rb	(revision 59897)
@@ -103,6 +103,42 @@ class TestWEBrickHTTPAuth < Test::Unit:: https://github.com/ruby/ruby/blob/trunk/test/webrick/test_httpauth.rb#L103
     }
   end
 
+  def test_bad_username_with_control_characters
+    log_tester = lambda {|log, access_log|
+      assert_equal(2, log.length)
+      assert_match(/ERROR Basic WEBrick's realm: foo\\ebar: the user is not allowed./, log[0])
+      assert_match(/ERROR WEBrick::HTTPStatus::Unauthorized/, log[1])
+    }
+    TestWEBrick.start_httpserver({}, log_tester) {|server, addr, port, log|
+      realm = "WEBrick's realm"
+      path = "/basic_auth"
+
+      Tempfile.create("test_webrick_auth") {|tmpfile|
+        tmpfile.close
+        tmp_pass = WEBrick::HTTPAuth::Htpasswd.new(tmpfile.path)
+        tmp_pass.set_passwd(realm, "webrick", "supersecretpassword")
+        tmp_pass.set_passwd(realm, "foo", "supersecretpassword")
+        tmp_pass.flush
+
+        htpasswd = WEBrick::HTTPAuth::Htpasswd.new(tmpfile.path)
+        users = []
+        htpasswd.each{|user, pass| users << user }
+        server.mount_proc(path){|req, res|
+          auth = WEBrick::HTTPAuth::BasicAuth.new(
+            :Realm => realm, :UserDB => htpasswd,
+            :Logger => server.logger
+          )
+          auth.authenticate(req, res)
+          res.body = "hoge"
+        }
+        http = Net::HTTP.new(addr, port)
+        g = Net::HTTP::Get.new(path)
+        g.basic_auth("foo\ebar", "passwd")
+        http.request(g){|res| assert_not_equal("hoge", res.body, log.call) }
+      }
+    }
+  end
+
   DIGESTRES_ = /
     ([a-zA-Z\-]+)
       [ \t]*(?:\r\n[ \t]*)*

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/