File CVE-2014-2538-src.patch of Package rubygem-rack-ssl
diff --git a/lib/rack/ssl.rb b/lib/rack/ssl.rb
index 146dd7b..a548aba 100644
--- a/lib/rack/ssl.rb
+++ b/lib/rack/ssl.rb
@@ -46,13 +46,14 @@ module Rack
end
def redirect_to_https(env)
- req = Request.new(env)
- url = URI(req.url)
- url.scheme = "https"
- url.host = @host if @host
- status = %w[GET HEAD].include?(req.request_method) ? 301 : 307
- headers = hsts_headers.merge('Content-Type' => 'text/html',
- 'Location' => url.to_s)
+ req = Request.new(env)
+
+ host = @host || req.host
+ location = "https://#{host}#{req.fullpath}"
+
+ status = %w[GET HEAD].include?(req.request_method) ? 301 : 307
+ headers = hsts_headers.merge('Content-Type' => 'text/html',
+ 'Location' => location)
[status, headers, []]
end