From af5d2f57baa4ea6ee070343e0d28616f9d44e746 Mon Sep 17 00:00:00 2001 From: Samuel Williams Date: Fri, 27 Jan 2023 02:57:26 -0800 Subject: [PATCH] Body should be non-frozen by default. (#103) --- lib/webrick/httpresponse.rb | 4 ++-- test/webrick/test_httpresponse.rb | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb index 9b8837c..dde0261 100644 --- a/lib/webrick/httpresponse.rb +++ b/lib/webrick/httpresponse.rb @@ -122,7 +122,7 @@ def initialize(config) @status = HTTPStatus::RC_OK @reason_phrase = nil @http_version = HTTPVersion::convert(@config[:HTTPVersion]) - @body = '' + @body = +"" @keep_alive = true @cookies = [] @request_method = nil @@ -441,7 +441,7 @@ def check_header(header_value) # :stopdoc: def error_body(backtrace, ex, host, port) - @body = +'' + @body = +"" @body << <<-_end_of_html_ diff --git a/test/webrick/test_httpresponse.rb b/test/webrick/test_httpresponse.rb index 1a2bc3e..9909ded 100644 --- a/test/webrick/test_httpresponse.rb +++ b/test/webrick/test_httpresponse.rb @@ -28,6 +28,10 @@ def setup @res.keep_alive = true end + def test_response_body_not_frozen + refute @res.body.frozen? + end + def test_prevent_response_splitting_headers_crlf res['X-header'] = "malicious\r\nCookie: cracked_indicator_for_test" io = StringIO.new