|
 |
29c6b9 |
commit 95ba9053e20ad8d113af37b3f1f4cbfff1f6a8f1
|
|
|
29c6b9 |
Author: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
|
|
|
29c6b9 |
Date: Wed Jul 7 10:38:10 2021 +0000
|
|
|
29c6b9 |
|
|
|
29c6b9 |
Fix StartTLS stripping vulnerability
|
|
|
29c6b9 |
|
|
|
29c6b9 |
Reported by Alexandr Savca in https://hackerone.com/reports/1178562
|
|
|
29c6b9 |
|
|
|
29c6b9 |
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
|
|
|
29c6b9 |
|
|
|
29c6b9 |
|
|
|
29c6b9 |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
29c6b9 |
|
|
|
29c6b9 |
diff --git a/lib/net/imap.rb b/lib/net/imap.rb
|
|
|
29c6b9 |
index 1c7e89ba14..91df89b79e 100644
|
|
|
29c6b9 |
--- a/lib/net/imap.rb
|
|
|
29c6b9 |
+++ b/lib/net/imap.rb
|
|
|
29c6b9 |
@@ -1213,12 +1213,14 @@ def get_tagged_response(tag, cmd)
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
resp = @tagged_responses.delete(tag)
|
|
|
29c6b9 |
case resp.name
|
|
|
29c6b9 |
+ when /\A(?:OK)\z/ni
|
|
|
29c6b9 |
+ return resp
|
|
|
29c6b9 |
when /\A(?:NO)\z/ni
|
|
|
29c6b9 |
raise NoResponseError, resp
|
|
|
29c6b9 |
when /\A(?:BAD)\z/ni
|
|
|
29c6b9 |
raise BadResponseError, resp
|
|
|
29c6b9 |
else
|
|
|
29c6b9 |
- return resp
|
|
|
29c6b9 |
+ raise UnknownResponseError, resp
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
|
|
|
29c6b9 |
@@ -3714,6 +3716,10 @@ class BadResponseError < ResponseError
|
|
|
29c6b9 |
class ByeResponseError < ResponseError
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
|
|
|
29c6b9 |
+ # Error raised upon an unknown response from the server.
|
|
|
29c6b9 |
+ class UnknownResponseError < ResponseError
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+
|
|
|
29c6b9 |
RESPONSE_ERRORS = Hash.new(ResponseError)
|
|
|
29c6b9 |
RESPONSE_ERRORS["NO"] = NoResponseError
|
|
|
29c6b9 |
RESPONSE_ERRORS["BAD"] = BadResponseError
|
|
|
29c6b9 |
diff --git a/test/net/imap/test_imap.rb b/test/net/imap/test_imap.rb
|
|
|
29c6b9 |
index 936f4e0f42..81928cb8fe 100644
|
|
|
29c6b9 |
--- a/test/net/imap/test_imap.rb
|
|
|
29c6b9 |
+++ b/test/net/imap/test_imap.rb
|
|
|
29c6b9 |
@@ -127,6 +127,24 @@ def test_starttls
|
|
|
29c6b9 |
imap.disconnect
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
+
|
|
|
29c6b9 |
+ def test_starttls_stripping
|
|
|
29c6b9 |
+ starttls_stripping_test do |port|
|
|
|
29c6b9 |
+ imap = Net::IMAP.new("localhost", :port => port)
|
|
|
29c6b9 |
+ assert_raise(Net::IMAP::UnknownResponseError) do
|
|
|
29c6b9 |
+ imap.starttls(:ca_file => CA_FILE)
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ imap
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+
|
|
|
29c6b9 |
+ def start_server
|
|
|
29c6b9 |
+ th = Thread.new do
|
|
|
29c6b9 |
+ yield
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ @threads << th
|
|
|
29c6b9 |
+ sleep 0.1 until th.stop?
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
|
|
|
29c6b9 |
def test_unexpected_eof
|
|
|
29c6b9 |
@@ -760,6 +760,27 @@ def starttls_test
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
end
|
|
|
29c6b9 |
|
|
|
29c6b9 |
+ def starttls_stripping_test
|
|
|
29c6b9 |
+ server = create_tcp_server
|
|
|
29c6b9 |
+ port = server.addr[1]
|
|
|
29c6b9 |
+ start_server do
|
|
|
29c6b9 |
+ sock = server.accept
|
|
|
29c6b9 |
+ begin
|
|
|
29c6b9 |
+ sock.print("* OK test server\r\n")
|
|
|
29c6b9 |
+ sock.gets
|
|
|
29c6b9 |
+ sock.print("RUBY0001 BUG unhandled command\r\n")
|
|
|
29c6b9 |
+ ensure
|
|
|
29c6b9 |
+ sock.close
|
|
|
29c6b9 |
+ server.close
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ begin
|
|
|
29c6b9 |
+ imap = yield(port)
|
|
|
29c6b9 |
+ ensure
|
|
|
29c6b9 |
+ imap.disconnect if imap && !imap.disconnected?
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+ end
|
|
|
29c6b9 |
+
|
|
|
29c6b9 |
def create_tcp_server
|
|
|
29c6b9 |
return TCPServer.new(server_addr, 0)
|
|
|
29c6b9 |
end
|