Merge 56743c7 into 29e26cc

lib/addressable/uri.rb

@@ -44,6 +44,7 @@ module CharacterClasses
       UNRESERVED = ALPHA + DIGIT + "\\-\\.\\_\\~"
       PCHAR = UNRESERVED + SUB_DELIMS + "\\:\\@"
       SCHEME = ALPHA + DIGIT + "\\-\\+\\."
+      HOST = ALPHA + DIGIT + "\\-\\.\\[\\:\\]"
       AUTHORITY = PCHAR
       PATH = PCHAR + "\\/"
       QUERY = PCHAR + "\\/\\?"
@@ -1075,6 +1076,9 @@ def normalized_host
             # Single trailing dots are unnecessary.
             result = result[0...-1]
           end
+          result = Addressable::URI.normalize_component(
+            result,
+            CharacterClasses::HOST)
           result
         else
           EMPTY_STR
@@ -1094,7 +1098,7 @@ def host=(new_host)
 
       unreserved = CharacterClasses::UNRESERVED
       sub_delims = CharacterClasses::SUB_DELIMS
-      if @host != nil && (@host =~ /[<>{}\/\?\#\@"]/ ||
+      if @host != nil && (@host =~ /[<>{}\/\?\#\@"[[:space:]]]/ ||
           (@host[/^\[(.*)\]$/, 1] != nil && @host[/^\[(.*)\]$/, 1] !~
           Regexp.new("^[#{unreserved}#{sub_delims}:]*$")))
         raise InvalidURIError, "Invalid character in host: '#{@host.to_s}'"

spec/addressable/uri_spec.rb

@@ -168,6 +168,40 @@ def to_s
   end
 end
 
+describe Addressable::URI, "newline normalization" do
+  it "should not unescape newline in scheme" do
+    uri = Addressable::URI.parse("ht%0atp://localhost/").normalize
+    expect(uri.to_s).to eq("ht%0Atp://localhost/")
+  end
+
+  it "should not unescape newline in path" do
+    uri = Addressable::URI.parse("http://localhost/%0a").normalize
+    expect(uri.to_s).to eq("http://localhost/%0A")
+  end
+
+  it "should not unescape newline in hostname" do
+    uri = Addressable::URI.parse("http://local%0ahost/").normalize
+    expect(uri.to_s).to eq("http://local%0Ahost/")
+  end
+
+  it "should not unescape newline in username" do
+    uri = Addressable::URI.parse("http://foo%0abar@localhost/").normalize
+    expect(uri.to_s).to eq("http://foo%0Abar@localhost/")
+  end
+
+  it "should not unescape newline in username" do
+    uri = Addressable::URI.parse("http://example:foo%0abar@localhost/").normalize
+    expect(uri.to_s).to eq("http://example:foo%0Abar@localhost/")
+  end
+
+  it "should not accept newline in hostname" do
+    uri = Addressable::URI.parse("http://localhost/")
+    expect(lambda do
+      uri.host = "local\nhost"
+    end).to raise_error(Addressable::URI::InvalidURIError)
+  end
+end
+
 describe Addressable::URI, "when created with ambiguous path" do
   it "should raise an error" do
     expect(lambda do