Hiroshi Nakamura nahi

## 0001-Fix-SSL-client-connection-crash-for-SAN-marked-criti.patch
From 61c3537bd9f8e37b01a8e45644c489fd8696c94b Mon Sep 17 00:00:00 2001
From: Hiroshi Nakamura <nahi@ruby-lang.org>
Date: Fri, 5 Jul 2013 23:22:29 +0900
Subject: [PATCH] Fix SSL client connection crash for SAN marked critical

The patch for CVE-2013-4073 caused SSL crash when a SSL server returns
the certificate that has critical SAN value.  X509 extension could
include 2 or 3 elements in it;

[id, criticality, octet_string] if critical,

## null_bytes_in_san_cert.pem
-----BEGIN CERTIFICATE-----
MIIBmjCCAUSgAwIBAgICBNIwDQYJKoZIhvcNAQEFBQAwQDEUMBIGCgmSJomT8ixk
ARkWBHNvbWUxFDASBgoJkiaJk/IsZAEZFgRzaXRlMRIwEAYDVQQDDAlTb21lIFNp
dGUwHhcNMTMwNTI0MDA1MzUwWhcNMTMwNTI0MDA1MzUwWjBAMRQwEgYKCZImiZPy
LGQBGRYEc29tZTEUMBIGCgmSJomT8ixkARkWBHNpdGUxEjAQBgNVBAMMCVNvbWUg
U2l0ZTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCnY4jdC2xJja4+LIBk49M+n4h/
eJqZ4w1x2WGZIABIhA9rO9yZBGqyUgEHwGk4dzPv5vp1ANYDYLLTD9pltzKlAgMB
AAGjKDAmMCQGA1UdEQQdMBuCGXd3dy5leGFtcGxlLmNvbQAuZXZpbC5jb20wDQYJ
KoZIhvcNAQEFBQADQQCBLd3QLJv96/5kjrSnL0n6VRhyHrFudPCNsfG1/BUOCaCk
kDlGeAyQDBqPk+SSOSlh1WlBZyiX+nmAgXdhuyge

## 0001-Hostname-check-bypassing-vulnerability-in-SSL-client.patch
From ddaf5b57bdc051ccc1161ec5273a59d30fc2fb72 Mon Sep 17 00:00:00 2001
From: Hiroshi Nakamura <nahi@ruby-lang.org>
Date: Wed, 5 Jun 2013 23:14:16 +0900
Subject: [PATCH] Hostname check bypassing vulnerability in SSL client
 (CVE-2013-4073)

Ruby's SSL client implements hostname identity check but the OpenSSL
function it depends cannot properly handle hostnames in subjectAltName
that contain null bytes.  The fix parses DER encoded bytes of
subjectAltName to extract GeneralName of dNSName and check it against

## gist:4449729
require 'refinement'

module StringForceEncodingConcat
  refine String do
    def +(rhs)
      begin
        super
      rescue Encoding::CompatibilityError
        super(rhs.force_encoding(self.encoding))
      end

## protected.rb
class Node
  def eval(other)
    other.protected_method(self)
  end

protected

  def protected_method(other)
    other
  end

## signed_request.json
{
  "context": {
    "user": {
      "fullName": "Nakamura Hiroshi",
      "userId": "005x0000000KzS8AAK",
      "userName": "XXXX",
      "email": "XXXX",
      "profilePhotoUrl": "/profilephoto/005/F",
      ...
    },

## JPACollision.java
public class JPACollision {
    public static void main(String[] args) {
        byte[] bytes1 = new byte[] {
            0x58, (byte) 0xa1, (byte) 0x82, 0x6c, 0x00, 0x00, (byte) 0xb1, 0x3b
        };
        byte[] bytes2 = new byte[] {
            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
        };
        byte[] bytes12 = concat(bytes1, bytes2);
        byte[] bytes21 = concat(bytes2, bytes1);

## gist:2951537
% cat Switch.java
public class Switch {
    public static void main(String[] args) {
	switch(args[0]) {
	    case "abc":
		break;
	    default:
		break;
	}
    }

## gist:2922421
% mkdir foo
% echo 'p [__FILE__, __LINE__, File.read(File.expand_path("./baz.txt", File.dirname(__FILE__)))]' > foo/bar.rb
% echo hello,world > foo/baz.txt
% jar -cf foo.jar foo
% rm -rf foo
% jruby -e '$LOAD_PATH << "foo.jar"; require "foo/bar"'
["jar:file:foo.jar!/foo/bar.rb", 1, "hello,world\n"]


% mkdir foo

## gist:2617669
# Run this with trunk (Tested with ae4fa795)
1.upto(24).each do |size|
  p size
  File.open(IO::NULL, "w") do |w|
    File.open(__FILE__) do |r|
      buf = ''
      while !r.read(size, buf).nil?
        w << buf # It works when you remove this line.
      end
    end
	From 61c3537bd9f8e37b01a8e45644c489fd8696c94b Mon Sep 17 00:00:00 2001
	From: Hiroshi Nakamura <nahi@ruby-lang.org>
	Date: Fri, 5 Jul 2013 23:22:29 +0900
	Subject: [PATCH] Fix SSL client connection crash for SAN marked critical

	The patch for CVE-2013-4073 caused SSL crash when a SSL server returns
	the certificate that has critical SAN value. X509 extension could
	include 2 or 3 elements in it;

	[id, criticality, octet_string] if critical,
	-----BEGIN CERTIFICATE-----
	MIIBmjCCAUSgAwIBAgICBNIwDQYJKoZIhvcNAQEFBQAwQDEUMBIGCgmSJomT8ixk
	ARkWBHNvbWUxFDASBgoJkiaJk/IsZAEZFgRzaXRlMRIwEAYDVQQDDAlTb21lIFNp
	dGUwHhcNMTMwNTI0MDA1MzUwWhcNMTMwNTI0MDA1MzUwWjBAMRQwEgYKCZImiZPy
	LGQBGRYEc29tZTEUMBIGCgmSJomT8ixkARkWBHNpdGUxEjAQBgNVBAMMCVNvbWUg
	U2l0ZTBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCnY4jdC2xJja4+LIBk49M+n4h/
	eJqZ4w1x2WGZIABIhA9rO9yZBGqyUgEHwGk4dzPv5vp1ANYDYLLTD9pltzKlAgMB
	AAGjKDAmMCQGA1UdEQQdMBuCGXd3dy5leGFtcGxlLmNvbQAuZXZpbC5jb20wDQYJ
	KoZIhvcNAQEFBQADQQCBLd3QLJv96/5kjrSnL0n6VRhyHrFudPCNsfG1/BUOCaCk
	kDlGeAyQDBqPk+SSOSlh1WlBZyiX+nmAgXdhuyge
	From ddaf5b57bdc051ccc1161ec5273a59d30fc2fb72 Mon Sep 17 00:00:00 2001
	From: Hiroshi Nakamura <nahi@ruby-lang.org>
	Date: Wed, 5 Jun 2013 23:14:16 +0900
	Subject: [PATCH] Hostname check bypassing vulnerability in SSL client
	(CVE-2013-4073)

	Ruby's SSL client implements hostname identity check but the OpenSSL
	function it depends cannot properly handle hostnames in subjectAltName
	that contain null bytes. The fix parses DER encoded bytes of
	subjectAltName to extract GeneralName of dNSName and check it against
	require 'refinement'

	module StringForceEncodingConcat
	refine String do
	def +(rhs)
	begin
	super
	rescue Encoding::CompatibilityError
	super(rhs.force_encoding(self.encoding))
	end
	class Node
	def eval(other)
	other.protected_method(self)
	end

	protected

	def protected_method(other)
	other
	end
	{
	"context": {
	"user": {
	"fullName": "Nakamura Hiroshi",
	"userId": "005x0000000KzS8AAK",
	"userName": "XXXX",
	"email": "XXXX",
	"profilePhotoUrl": "/profilephoto/005/F",
	...
	},
	public class JPACollision {
	public static void main(String[] args) {
	byte[] bytes1 = new byte[] {
	0x58, (byte) 0xa1, (byte) 0x82, 0x6c, 0x00, 0x00, (byte) 0xb1, 0x3b
	};
	byte[] bytes2 = new byte[] {
	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
	};
	byte[] bytes12 = concat(bytes1, bytes2);
	byte[] bytes21 = concat(bytes2, bytes1);
	% cat Switch.java
	public class Switch {
	public static void main(String[] args) {
	switch(args[0]) {
	case "abc":
	break;
	default:
	break;
	}
	}
	% mkdir foo
	% echo 'p [__FILE__, __LINE__, File.read(File.expand_path("./baz.txt", File.dirname(__FILE__)))]' > foo/bar.rb
	% echo hello,world > foo/baz.txt
	% jar -cf foo.jar foo
	% rm -rf foo
	% jruby -e '$LOAD_PATH << "foo.jar"; require "foo/bar"'
	["jar:file:foo.jar!/foo/bar.rb", 1, "hello,world\n"]


	% mkdir foo
	# Run this with trunk (Tested with ae4fa795)
	1.upto(24).each do \|size\|
	p size
	File.open(IO::NULL, "w") do \|w\|
	File.open(__FILE__) do \|r\|
	buf = ''
	while !r.read(size, buf).nil?
	w << buf # It works when you remove this line.
	end
	end