157634
commit 95ba9053e20ad8d113af37b3f1f4cbfff1f6a8f1
157634
Author: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
157634
Date:   Wed Jul 7 10:38:10 2021 +0000
157634
157634
    Fix StartTLS stripping vulnerability
157634
    
157634
    Reported by Alexandr Savca in https://hackerone.com/reports/1178562
157634
    
157634
    Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
157634
    
157634
    
157634
    git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
157634
157634
diff --git a/lib/net/imap.rb b/lib/net/imap.rb
157634
index 1c7e89ba14..91df89b79e 100644
157634
--- a/lib/net/imap.rb
157634
+++ b/lib/net/imap.rb
157634
@@ -1213,12 +1213,14 @@ def get_tagged_response(tag, cmd)
157634
       end
157634
       resp = @tagged_responses.delete(tag)
157634
       case resp.name
157634
+      when /\A(?:OK)\z/ni
157634
+        return resp
157634
       when /\A(?:NO)\z/ni
157634
         raise NoResponseError, resp
157634
       when /\A(?:BAD)\z/ni
157634
         raise BadResponseError, resp
157634
       else
157634
-        return resp
157634
+        raise UnknownResponseError, resp
157634
       end
157634
     end
157634
 
157634
@@ -3714,6 +3716,10 @@ class BadResponseError < ResponseError
157634
     class ByeResponseError < ResponseError
157634
     end
157634
 
157634
+    # Error raised upon an unknown response from the server.
157634
+    class UnknownResponseError < ResponseError
157634
+    end
157634
+
157634
     RESPONSE_ERRORS = Hash.new(ResponseError)
157634
     RESPONSE_ERRORS["NO"] = NoResponseError
157634
     RESPONSE_ERRORS["BAD"] = BadResponseError
157634
diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb
157634
index 936f4e0f42..81928cb8fe 100644
157634
--- a/test/net/imap/test_imap.rb
157634
+++ b/test/net/imap/test_imap.rb
157634
@@ -127,6 +127,24 @@ def test_starttls
157634
         imap.disconnect
157634
       end
157634
     end
157634
+
157634
+    def test_starttls_stripping
157634
+      starttls_stripping_test do |port|
157634
+        imap = Net::IMAP.new("localhost", :port => port)
157634
+        assert_raise(Net::IMAP::UnknownResponseError) do
157634
+          imap.starttls(:ca_file => CA_FILE)
157634
+        end
157634
+        imap
157634
+      end
157634
+    end
157634
+  end
157634
+
157634
+  def start_server
157634
+    th = Thread.new do
157634
+      yield
157634
+    end
157634
+    @threads << th
157634
+    sleep 0.1 until th.stop?
157634
   end
157634
 
157634
   def test_unexpected_eof
157634
@@ -760,6 +760,27 @@ def starttls_test
157634
     end
157634
   end
157634
 
157634
+  def starttls_stripping_test
157634
+    server = create_tcp_server
157634
+    port = server.addr[1]
157634
+    start_server do
157634
+      sock = server.accept
157634
+      begin
157634
+        sock.print("* OK test server\r\n")
157634
+        sock.gets
157634
+        sock.print("RUBY0001 BUG unhandled command\r\n")
157634
+      ensure
157634
+        sock.close
157634
+        server.close
157634
+      end
157634
+    end
157634
+    begin
157634
+      imap = yield(port)
157634
+    ensure
157634
+      imap.disconnect if imap && !imap.disconnected?
157634
+    end
157634
+  end
157634
+
157634
   def create_tcp_server
157634
     return TCPServer.new(server_addr, 0)
157634
   end