Skip to content

Commit

Permalink
Test backport
Browse files Browse the repository at this point in the history
  • Loading branch information
nateberkopec committed Feb 27, 2020
1 parent 37928cb commit 3a2b918
Showing 1 changed file with 19 additions and 3 deletions.
22 changes: 19 additions & 3 deletions test/test_puma_server.rb
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,13 @@ def header(sock)
header
end

def send_http_and_read(req)
port = @server.connected_port
sock = TCPSocket.new @host, port
sock << req
sock.read
end

def test_proper_stringio_body
data = nil

Expand Down Expand Up @@ -743,19 +750,28 @@ def test_empty_header_values

# https://github.com/ruby/ruby/commit/d9d4a28f1cdd05a0e8dabb36d747d40bbcc30f16
def test_prevent_response_splitting_headers
server_run app: ->(_) { [200, {'X-header' => "malicious\r\nCookie: hack"}, ["Hello"]] }
@server.app = ->(_) { [200, {'X-header' => "malicious\r\nCookie: hack"}, ["Hello"]] }

@server.add_tcp_listener @host, @port
@server.run
data = send_http_and_read "HEAD / HTTP/1.0\r\n\r\n"
refute_match 'hack', data
end

def test_prevent_response_splitting_headers_cr
server_run app: ->(_) { [200, {'X-header' => "malicious\rCookie: hack"}, ["Hello"]] }
@server.app = ->(_) { [200, {'X-header' => "malicious\rCookie: hack"}, ["Hello"]] }

@server.add_tcp_listener @host, @port
@server.run
data = send_http_and_read "HEAD / HTTP/1.0\r\n\r\n"
refute_match 'hack', data
end

def test_prevent_response_splitting_headers_lf
server_run app: ->(_) { [200, {'X-header' => "malicious\nCookie: hack"}, ["Hello"]] }
@server.app = ->(_) { [200, {'X-header' => "malicious\nCookie: hack"}, ["Hello"]] }

@server.add_tcp_listener @host, @port
@server.run
data = send_http_and_read "HEAD / HTTP/1.0\r\n\r\n"
refute_match 'hack', data
end
Expand Down

0 comments on commit 3a2b918

Please sign in to comment.