admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

Prohibit non-ASCII characters in URLs, nudge toward punycode

Browse Source 
Inspired by curl's blog post, [Detecting malicious Unicode][1], this likely captures most if not all cases and nudges the user toward supplying IDNs with punycode.

A possible improvement would be telling the user exactly what punycode domain to use instead, but that may require another library as I can't quickly find something built into the Ruby stdlib that handles punycode encoding.

[1]: https://daniel.haxx.se/blog/2025/05/16/detecting-malicious-unicode/

Co-authored-by: Štefan Baebler <319826+stefanb@users.noreply.github.com>
This commit is contained in:
Colin Dean 2025-05-20 11:06:20 -04:00 committed by Mike McQuaid
parent 33a6d21eef
commit d5b3ae095c
No known key found for this signature in database
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Library/Homebrew/rubocops/shared/url_helper.rb
View File

@ -35,6 +35,12 @@ module RuboCop
def audit_url(type, urls, mirrors, livecheck_url: false) def audit_url(type, urls, mirrors, livecheck_url: false)
@type = type @type = type
# URLs must be ASCII; IDNs must be punycode
ascii_pattern = /[^\p{ASCII}]+/
audit_urls(urls, ascii_pattern) do |_, url|
problem "Please use the ASCII (Punycode encoded host, URL-encoded path and query) version of #{url}."
end
# GNU URLs; doesn't apply to mirrors # GNU URLs; doesn't apply to mirrors
gnu_pattern = %r{^(?:https?|ftp)://ftpmirror\.gnu\.org/(.*)} gnu_pattern = %r{^(?:https?|ftp)://ftpmirror\.gnu\.org/(.*)}
audit_urls(urls, gnu_pattern) do |match, url| audit_urls(urls, gnu_pattern) do |match, url|

8
Library/Homebrew/test/rubocops/urls_spec.rb
View File

@ -177,6 +177,14 @@ RSpec.describe RuboCop::Cop::FormulaAudit::Urls do
"url" => "svn+http://brew.sh/foo/bar", "url" => "svn+http://brew.sh/foo/bar",
"msg" => "Use of the svn+http:// scheme is deprecated, pass `:using => :svn` instead", "msg" => "Use of the svn+http:// scheme is deprecated, pass `:using => :svn` instead",
"col" => 2, "col" => 2,
}, {
"url" => "https://🫠.sh/foo/bar",
"msg" => "Please use the ASCII (Punycode encoded host, URL-encoded path and query) version of https://🫠.sh/foo/bar.",
"col" => 2,
}, {
"url" => "https://ßreｗ.sh/foo/bar",
"msg" => "Please use the ASCII (Punycode encoded host, URL-encoded path and query) version of https://ßreｗ.sh/foo/bar.",
"col" => 2,
}] }]
end end