nahi

From 61c3537bd9f8e37b01a8e45644c489fd8696c94b Mon Sep 17 00:00:00 2001
From: Hiroshi Nakamura <nahi@ruby-lang.org>
Date: Fri, 5 Jul 2013 23:22:29 +0900
Subject: [PATCH] Fix SSL client connection crash for SAN marked critical

The patch for CVE-2013-4073 caused SSL crash when a SSL server returns
the certificate that has critical SAN value.  X509 extension could
include 2 or 3 elements in it;

[id, criticality, octet_string] if critical,

nahi

-----BEGIN CERTIFICATE-----
MIIBmjCCAUSgAwIBAgICBNIwDQYJKoZIhvcNAQEFBQAwQDEUMBIGCgmSJomT8ixk
ARkWBHNvbWUxFDASBgoJkiaJk/IsZAEZFgRzaXRlMRIwEAYDVQQDDAlTb21lIFNp
dGUwHhcNMTMwNTI0MDA1MzUwWhcNMTMwNTI0MDA1MzUwWjBAMRQwEgYKCZImiZPy
LGQBGRYEc29tZTEUMBIGCgmSJomT8ixkARkWBHNpdGUxEjAQBgNVBAMMCVNvbWUg
U2l0ZTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCnY4jdC2xJja4+LIBk49M+n4h/
eJqZ4w1x2WGZIABIhA9rO9yZBGqyUgEHwGk4dzPv5vp1ANYDYLLTD9pltzKlAgMB
AAGjKDAmMCQGA1UdEQQdMBuCGXd3dy5leGFtcGxlLmNvbQAuZXZpbC5jb20wDQYJ
KoZIhvcNAQEFBQADQQCBLd3QLJv96/5kjrSnL0n6VRhyHrFudPCNsfG1/BUOCaCk
kDlGeAyQDBqPk+SSOSlh1WlBZyiX+nmAgXdhuyge

nahi

From ddaf5b57bdc051ccc1161ec5273a59d30fc2fb72 Mon Sep 17 00:00:00 2001
From: Hiroshi Nakamura <nahi@ruby-lang.org>
Date: Wed, 5 Jun 2013 23:14:16 +0900
Subject: [PATCH] Hostname check bypassing vulnerability in SSL client
 (CVE-2013-4073)

Ruby's SSL client implements hostname identity check but the OpenSSL
function it depends cannot properly handle hostnames in subjectAltName
that contain null bytes.  The fix parses DER encoded bytes of
subjectAltName to extract GeneralName of dNSName and check it against

nahi

require 'refinement'

module StringForceEncodingConcat
  refine String do
    def +(rhs)
      begin
        super
      rescue Encoding::CompatibilityError
        super(rhs.force_encoding(self.encoding))
      end

nahi

class Node
  def eval(other)
    other.protected_method(self)
  end

protected

  def protected_method(other)
    other
  end

nahi

{
  "context": {
    "user": {
      "fullName": "Nakamura Hiroshi",
      "userId": "005x0000000KzS8AAK",
      "userName": "XXXX",
      "email": "XXXX",
      "profilePhotoUrl": "/profilephoto/005/F",
      ...
    },

nahi

public class JPACollision {
    public static void main(String[] args) {
        byte[] bytes1 = new byte[] {
            0x58, (byte) 0xa1, (byte) 0x82, 0x6c, 0x00, 0x00, (byte) 0xb1, 0x3b
        };
        byte[] bytes2 = new byte[] {
            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
        };
        byte[] bytes12 = concat(bytes1, bytes2);
        byte[] bytes21 = concat(bytes2, bytes1);

nahi

% cat Switch.java
public class Switch {
    public static void main(String[] args) {
	switch(args[0]) {
	    case "abc":
		break;
	    default:
		break;
	}
    }

nahi

% mkdir foo
% echo 'p [__FILE__, __LINE__, File.read(File.expand_path("./baz.txt", File.dirname(__FILE__)))]' > foo/bar.rb
% echo hello,world > foo/baz.txt
% jar -cf foo.jar foo                                                                                         
% rm -rf foo
% jruby -e '$LOAD_PATH << "foo.jar"; require "foo/bar"'                                                       
["jar:file:foo.jar!/foo/bar.rb", 1, "hello,world\n"]


% mkdir foo

nahi

# Run this with trunk (Tested with ae4fa795)
1.upto(24).each do |size|
  p size
  File.open(IO::NULL, "w") do |w|
    File.open(__FILE__) do |r|
      buf = ''
      while !r.read(size, buf).nil?
        w << buf # It works when you remove this line.
      end
    end