File CVE-2024-47220.patch of Package ruby2.1.36279

diff -ru ruby-2.1.9.orig/lib/webrick/httprequest.rb ruby-2.1.9/lib/webrick/httprequest.rb
--- ruby-2.1.9.orig/lib/webrick/httprequest.rb	2024-10-29 13:40:11.865094013 +0100
+++ ruby-2.1.9/lib/webrick/httprequest.rb	2024-10-29 13:40:55.129540898 +0100
@@ -473,6 +473,10 @@
     def read_body(socket, block)
       return unless socket
       if tc = self['transfer-encoding']
+        if self['content-length']   
+          raise HTTPStatus::BadRequest, "request with both transfer-encoding and content-length, possible request smuggling"
+        end
+
         case tc
         when /\Achunked\z/io then read_chunked(socket, block)
         else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
openSUSE Build Service is sponsored by