[ruby-core:111040] [Ruby master Bug#19157] URI bad component validation can be tricked

Issue #19157 has been reported by straight-shoota (Johannes M=FCller).



----------------------------------------

Bug #19157: URI bad component validation can be tricked

https://bugs.ruby-lang.org/issues/19157



* Author: straight-shoota (Johannes M=FCller)

* Status: Open

* Priority: Normal

* ruby -v: 3.1.3

* Backport: 2.7: UNKNOWN, 3.0: UNKNOWN, 3.1: UNKNOWN

----------------------------------------

`URI::HTTP` checks the validity of the URI components. For example, the pat=
h of a URI with authority component must be either empty or start with a sl=
ash.



This validation applies on the `.build` constructor as well as on the `path=
` setter.

But it can be tricked when setting an empty authority component and scheme =
before setting a relative path, and then setting the authority and scheme a=
gain.

This produces an invalid and incorrect URI.



``` ruby

require "uri"



uri =3D URI::HTTP.build({})

uri.scheme =3D nil

uri.path =3D "resource"

uri.host =3D "example.com" # this should raise URI::InvalidComponentError

uri.scheme =3D "http"

uri.to_s # =3D> "http://example.comresource"

```









--=20

https://bugs.ruby-lang.org/

 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-c=
ore.ml.ruby-lang.org/