blob: 33e88d652ee6e87cc0c2a1696027c2b888b5c963 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
require_relative '../spec_helper'
describe "String#gsub" do
it "resists CVE-2010-1330 by raising an exception on invalid UTF-8 bytes" do
# This original vulnerability talked about KCODE, which is no longer
# used. Instead we are forcing encodings here. But I think the idea is the
# same - we want to check that Ruby implementations raise an error on
# #gsub on a string in the UTF-8 encoding but with invalid an UTF-8 byte
# sequence.
str = "\xF6<script>"
str.force_encoding Encoding::BINARY
str.gsub(/</, "<").should == "\xF6<script>".b
str.force_encoding Encoding::UTF_8
-> {
str.gsub(/</, "<")
}.should raise_error(ArgumentError, /invalid byte sequence in UTF-8/)
end
end
|