Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix HTTP::Client certificate validation error on FQDN (host with trailing dot) #12778

Merged
merged 3 commits into from
Dec 20, 2022
Merged

Fix HTTP::Client certificate validation error on FQDN (host with trailing dot) #12778

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b5aa703
Fix HTTP::Client certificate validation error on FQDN (host with trai…
compumike Nov 22, 2022
5e69f8d
Add https_client_spec for fully-qualified host name with trailing dot
compumike Nov 22, 2022
34cc61b
Change chomp to rchop
compumike Dec 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions spec/manual/https_client_spec.cr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ describe "https requests" do
HTTP::Client.get("https://google.com")
end

it "can fetch from google.com. FQDN with trailing dot (#12777)" do
HTTP::Client.get("https://google.com.")
end

it "can close request before consuming body" do
HTTP::Client.get("https://crystal-lang.org") do
break
Expand Down
4 changes: 4 additions & 0 deletions spec/std/uri_spec.cr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,10 @@ describe "URI" do
assert_uri("http://[::1]:81/", scheme: "http", host: "[::1]", port: 81, path: "/")
assert_uri("http://192.0.2.16:81/", scheme: "http", host: "192.0.2.16", port: 81, path: "/")

# preserves fully-qualified host with trailing dot
assert_uri("https://example.com./", scheme: "https", host: "example.com.", path: "/")
assert_uri("https://example.com.:8443/", scheme: "https", host: "example.com.", port: 8443, path: "/")

# port
it { URI.parse("http://192.168.0.2:/foo").should eq URI.new(scheme: "http", host: "192.168.0.2", path: "/foo") }

Expand Down
2 changes: 1 addition & 1 deletion src/http/client.cr
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -801,7 +801,7 @@ class HTTP::Client
if tls = @tls
tcp_socket = io
begin
io = OpenSSL::SSL::Socket::Client.new(tcp_socket, context: tls, sync_close: true, hostname: @host)
io = OpenSSL::SSL::Socket::Client.new(tcp_socket, context: tls, sync_close: true, hostname: @host.rchop('.'))
rescue exc
# don't leak the TCP socket when the SSL connection failed
tcp_socket.close
Expand Down