diff options
| author | normal <normal@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-07-14 02:59:39 +0000 |
|---|---|---|
| committer | normal <normal@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-07-14 02:59:39 +0000 |
| commit | b9f9986a5e531975c97bdb695a86d6673713aedd (patch) | |
| tree | c2f2ab5f378a7264d62ba59206b2684b6eee0b85 /lib/webrick/httpresponse.rb | |
| parent | eb53b0ff05bbb62e9db5f3421cf38b691a14d91a (diff) | |
webrick/httpresponse: set_redirect requires a valid URI
Prevents response splitting and HTML injection attacks in
poorly-written applications which blindly pass along user input
in redirects.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@63964 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/webrick/httpresponse.rb')
| -rw-r--r-- | lib/webrick/httpresponse.rb | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb index 6d77692140..255a27f6b9 100644 --- a/lib/webrick/httpresponse.rb +++ b/lib/webrick/httpresponse.rb @@ -10,6 +10,7 @@ # $IPR: httpresponse.rb,v 1.45 2003/07/11 11:02:25 gotoyuzo Exp $ require 'time' +require 'uri' require 'webrick/httpversion' require 'webrick/htmlutils' require 'webrick/httputils' @@ -331,8 +332,9 @@ module WEBrick # res.set_redirect WEBrick::HTTPStatus::TemporaryRedirect def set_redirect(status, url) + url = URI(url).to_s @body = "<HTML><A HREF=\"#{url}\">#{url}</A>.</HTML>\n" - @header['location'] = url.to_s + @header['location'] = url raise status end |