Bug 1123048 - uri/common.rb from ruby-libs package should include #{reserved} in validation regex for USERINFO
Summary: uri/common.rb from ruby-libs package should include #{reserved} in validation...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ruby
Version: 7.0
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Vít Ondruch
QA Contact: BaseOS QE - Apps
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-07-24 17:31 UTC by Jerry
Modified: 2018-11-21 12:51 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-28 11:37:15 UTC


Attachments (Terms of Use)
a simple patch to fix this bug. (568 bytes, text/plain)
2014-07-24 17:31 UTC, Jerry
no flags Details

Description Jerry 2014-07-24 17:31:19 UTC
Created attachment 920649 [details]
a simple patch to fix this bug.

Description of problem:
A password containing '?' or other "reserved" character would fail validation.

Version-Release number of selected component (if applicable):
ruby-libs-2.0.0.353-20.el7.x86_64

How reproducible:
every time.

Steps to Reproduce:
1. yum -y update to update the os
2. run the following 
3. run this ruby snippet
----8<-------------8<-----
#! /usr/bin/env ruby

require 'uri/generic'

puts "reserved==#{URI::REGEXP::PATTERN::RESERVED}"

passwords = [ 'password1', 'password?']
passwords.each do |pass|
	puts "== to try with pass=(#{pass})"
	userinfo = "login:#{pass}"
	uri = URI::Generic.new('http', userinfo, 'localhost', 80, nil, '/v1', nil, '', '') 
	uri.userinfo=(userinfo)
end
----8<-------------8<-----

Actual results:
reserved==;/?:@&=+$,\[\]
== to try with pass=(password1)
== to try with pass=(password?)
/usr/share/ruby/uri/generic.rb:440:in `check_password': bad component(expected user component): password? (URI::InvalidComponentError)
	from /usr/share/ruby/uri/generic.rb:390:in `check_userinfo'
	from /usr/share/ruby/uri/generic.rb:455:in `userinfo='
	from /tmp/1:12:in `block in <main>'
	from /tmp/1:8:in `each'
	from /tmp/1:8:in `<main>'

Expected results:
no error thrown

Additional info:
The attached patch is verified as a fix for this particular problem.
btw, not sure this is by design or not: ruby-libs is not a valid component to report this against.
This is rather serious, I'd say, since many sites require non-alphanumerics.
reserved==;/?:@&=+$,\[\]
== to try with pass=(password1)
== to try with pass=(password?)

Comment 2 Vít Ondruch 2014-07-28 11:37:15 UTC
Hello Jerry,

Thanks for the report. I am afraid I can't do much about this issue, since accepting the patch would result in different behavior of Ruby on RHEL from other platforms.

If you believe, that Ruby's behavior is wrong, please report the bug upstream first [1] and we can reconsider the decision, when upstream accepts your patch. However, since the code exits since year 2002 and it is implemented according to RFCs, it is not likely that your patch would be accepted by upstream.

Thanks for understanding.


[1] https://bugs.ruby-lang.org/


Note You need to log in before you can comment on or make changes to this bug.