-
Notifications
You must be signed in to change notification settings - Fork 17
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3820 from alphagov/2938-silently-handle-invalid-b…
…yte-sequence-in-utf-8-errors-l-2 Handle incorrectly UTF-8 encoded query and cookie url
- Loading branch information
Showing
5 changed files
with
120 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,18 @@ | ||
module Sanitiser | ||
class Strategy | ||
class SanitisingError < StandardError; end | ||
|
||
class << self | ||
def call(input, sanitize_null_bytes: false) | ||
input | ||
.force_encoding(Encoding::ASCII_8BIT) | ||
.encode!(Encoding::UTF_8) | ||
if sanitize_null_bytes && Rack::UTF8Sanitizer::NULL_BYTE_REGEX.match?(input) | ||
raise NullByteInString | ||
end | ||
rescue StandardError | ||
raise SanitisingError, "Non-UTF-8 (or null) character in the query or in the cookie" | ||
end | ||
end | ||
end | ||
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,86 @@ | ||
require "slimmer/test" | ||
|
||
RSpec.describe "Sanitiser" do | ||
context "with query being correct percent-encoded UTF-8 string" do | ||
it "does not raise exception" do | ||
get "/?%41" | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
|
||
context "with query being incorrect percent-encoded UTF-8 string" do | ||
it "raises SanitisingError" do | ||
expect { get "/?%AD" }.to raise_error(Sanitiser::Strategy::SanitisingError) | ||
end | ||
end | ||
|
||
context "with cookie key being correct UTF-8" do | ||
it "does not raise exception" do | ||
get "/", headers: { Cookie: "\x41=value" } | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
|
||
context "with cookie key being incorrect UTF-8" do | ||
it "raises exception" do | ||
expect { get "/", headers: { Cookie: "\xAD=value" } } | ||
.to raise_error(ArgumentError, "invalid byte sequence in UTF-8") | ||
end | ||
end | ||
|
||
context "with cookie value being correct UTF-8" do | ||
it "does not raise exception" do | ||
get "/", headers: { Cookie: "key=\x41" } | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
|
||
context "with cookie value being incorrect UTF-8" do | ||
it "raises exception" do | ||
expect { get "/", headers: { Cookie: "key=\xAD" } } | ||
.to raise_error(ArgumentError, "invalid byte sequence in UTF-8") | ||
end | ||
end | ||
|
||
context "with cookie path being correct UTF-8" do | ||
it "does not raise exception" do | ||
get "/", headers: { Cookie: "key=value; Path=/\x41" } | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
|
||
context "with cookie path being incorrect UTF-8" do | ||
it "raises exception" do | ||
expect { get "/", headers: { Cookie: "key=value; Path=/\xAD" } } | ||
.to raise_error(ArgumentError, "invalid byte sequence in UTF-8") | ||
end | ||
end | ||
|
||
context "with cookie path being correct percent-encoded UTF-8" do | ||
it "does not raise exception" do | ||
get "/", headers: { Cookie: "key=value; Path=/%41" } | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
|
||
context "with cookie path being incorrect percent-encoded UTF-8" do | ||
it "raises SanitisingError" do | ||
expect { get "/", headers: { Cookie: "key=value; Path=/%AD" } } | ||
.to raise_error(Sanitiser::Strategy::SanitisingError) | ||
end | ||
end | ||
|
||
context "with referrer header being correct percent-encoded UTF-8" do | ||
it "does not raise exception" do | ||
get "/", headers: { Referer: "http://example.com/?%41" } | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
|
||
context "with referrer header being incorrect percent-encoded UTF-8" do | ||
it "does not raise exception" do | ||
get "/", headers: { Referer: "http://example.com/?%AD" } | ||
expect(response).to have_http_status(:ok) | ||
end | ||
end | ||
end |