Yusuke Endoh a041273a4c [ruby/net-http] Reject CR/LF in the address and port of a proxy CONNECT request ...

The CONNECT request line and its Host field were built from the address
and port without the CR/LF check that the other request components get.

Reported-by: Christiaan Swiers (https://hackerone.com/cswiers)

https://github.com/ruby/net-http/commit/a4af412951

Co-Authored-By: Claude Mythos 5.1 <noreply@anthropic.com>

2026-11-05 08:49:10 +00:00

..

fixtures

…

http

[ruby/net-http] Reject CR/LF in the address and port of a proxy CONNECT request

2026-11-05 08:49:10 +00:00

protocol

[ruby/net-protocol] Test that an exception out of a message leaves the IO usable

2026-09-17 03:25:27 +00:00