You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fixes a CRLF header injection vulnerability in the HTTP CONNECT request construction. Header names and values from proxy_connect_request_headers were interpolated directly into the raw CONNECT request buffer without sanitization, allowing HTTP request smuggling via the proxy if user-derived data flows into header values.
Changes
lib/ruby_proxy_headers.rb — Added RubyProxyHeaders.validate_header!(name, value) method that raises ArgumentError if a header name or value contains CR (\r), LF (\n), or NUL (\0) bytes.
lib/ruby_proxy_headers/net_http.rb — Calls validate_header! before interpolating each header into the CONNECT request buffer (line 85).
lib/ruby_proxy_headers/connection.rb — Same validation applied in build_connect_request before appending custom proxy headers.
spec/validate_header_spec.rb — Tests covering clean headers, CR/LF/NUL/CRLF rejection in names and values, and to_s coercion of non-string arguments.
Security Impact
Without this fix, an attacker who can influence proxy CONNECT header values (e.g., through an application that passes user input as X-ProxyMesh-IP) can inject arbitrary headers into the CONNECT request sent to the proxy, enabling request smuggling, proxy authentication manipulation, or IP spoofing through injected proxy control headers.
Add RubyProxyHeaders.validate_header! to reject header names and values
containing CR, LF, or NUL bytes before they are interpolated into raw
HTTP CONNECT requests. This prevents HTTP request smuggling via the
proxy when user-derived data flows into proxy_connect_request_headers.
Applied in both net_http.rb (production code path) and connection.rb
(standalone Connection class). Raises ArgumentError with a descriptive
message so callers are alerted to the injection attempt rather than
silently stripping characters.
Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer has been assigned.
Sent by Cursor Approval Agent: oss dependabot approver
Runs 'bundle exec rspec' on push to main and on pull requests across
Ruby 3.1, 3.2, and 3.3. Also adds webmock as a dev dependency in the
gemspec since spec/spec_helper.rb requires it.
Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer is already assigned.
Sent by Cursor Approval Agent: oss dependabot approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer is already assigned.
Sent by Cursor Approval Agent: oss dependabot approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer is already assigned.
Sent by Cursor Approval Agent: oss dependabot approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer is already assigned.
Sent by Cursor Approval Agent: oss dependabot approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer is already assigned.
Sent by Cursor Approval Agent: oss dependabot approver
- Pin actions/checkout to SHA (v6.0.3) across all workflows
- Pin rubygems/release-gem to SHA (v1.2.0)
- Keep ruby/setup-ruby@v1 unpinned per maintainer guidance (pinning
freezes available Ruby versions)
- Update Gemfile.lock with webmock dependency and refreshed checksums
- Fix BUNDLED WITH to 2.5.0 (bundler 4.0.8 is incompatible with the
Ruby 3.1 CI matrix entry)
Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Left a non-blocking review: this is a security-sensitive CONNECT header validation change, not a Dependabot version bump, so it is not auto-approved. Human review is required; a reviewer is already assigned.
Sent by Cursor Approval Agent: oss dependabot approver
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Summary
Fixes a CRLF header injection vulnerability in the HTTP CONNECT request construction. Header names and values from
proxy_connect_request_headerswere interpolated directly into the raw CONNECT request buffer without sanitization, allowing HTTP request smuggling via the proxy if user-derived data flows into header values.Changes
lib/ruby_proxy_headers.rb— AddedRubyProxyHeaders.validate_header!(name, value)method that raisesArgumentErrorif a header name or value contains CR (\r), LF (\n), or NUL (\0) bytes.lib/ruby_proxy_headers/net_http.rb— Callsvalidate_header!before interpolating each header into the CONNECT request buffer (line 85).lib/ruby_proxy_headers/connection.rb— Same validation applied inbuild_connect_requestbefore appending custom proxy headers.spec/validate_header_spec.rb— Tests covering clean headers, CR/LF/NUL/CRLF rejection in names and values, andto_scoercion of non-string arguments.Security Impact
Without this fix, an attacker who can influence proxy CONNECT header values (e.g., through an application that passes user input as
X-ProxyMesh-IP) can inject arbitrary headers into the CONNECT request sent to the proxy, enabling request smuggling, proxy authentication manipulation, or IP spoofing through injected proxy control headers.